restructure desktop/wm and remove nur

flake update
flake add hydraJobs
2024-05-19 17:57:35 +02:00 · 2024-05-09 21:28:57 +02:00 · 2024-05-05 20:12:39 +02:00 · 2024-05-05 20:09:55 +02:00 · 2024-05-05 20:09:02 +02:00 · 2024-05-05 20:05:19 +02:00
96 changed files with 2164 additions and 700 deletions
@@ -1,2 +1,34 @@
 # nixos-config

+## Install
+
+### Patitioning
+
+- Easiest is to run [disko](https://git.kabtop.de/Kabbone/nixos-config/src/branch/main/disko)
+- **Classic way:**
+Partition disk with gdisk:
+1. EFI Partition, size 512M, type "EF00", Label "NIXBOOT"
+
+2. Root Partition, size 100%, type "8300", Label "NIXROOT"
+
+### Installing
+
+1. mount all the partitions and subvolumes to /mnt
+
+2. generate initial nixos config
+```
+# nixos-generate-config --root /mnt
+```
+
+3. clone flake and check config
+```
+# cd /mnt/etc/nixos/
+# git clone https://git.kabtop.de/Kabbone/nixos-config.git
+```
+
+4. install system
+```
+# nixos-install --flake .#<host>
+```
+
+5. reboot
@@ -0,0 +1,37 @@
+## Step by step
+1. Boot the [installer](https://nixos.org/download.html#nixos-iso)
+
+2. Get disk name 
+```
+$ lsblk
+```
+
+3. Get disko config
+```
+$ curl https://git.kabtop.de/Kabbone/nixos-config/raw/branch/main/disko/btrfs_luks.nix -o /tmp/disko-config.nix
+```
+
+4. Adjust device name
+
+5. Let disko partition the disk
+```
+$ sudo nix --experimental-features "nix-command flakes" run github:nix-community/disko -- --mode disko /tmp/disko-config.nix
+```
+
+6. Check if it got mounted
+```
+$ mount | grep /mnt
+```
+
+7. Continue with NixOS installation
+Filesystem definitions come from disko, hence "--no-filesystems"
+```
+$ nixos-generate-config --no-filesystems --root /mnt
+$ mv /tmp/disko-config.nix /mnt/etc/nixos
+```
+
+**Alternative:** continue with normal hardware-config
+```
+$ nixos-generate-config --root /mnt
+```
+
@@ -0,0 +1,65 @@
+{
+  disko.devices = {
+    disk = {
+      nvme0n1 = {
+        type = "disk";
+        device = "/dev/nvme0n1";
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "512M";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                extraArgs = [ "-n NIXBOOT" ];
+                mountpoint = "/boot";
+                mountOptions = [
+                  "defaults"
+                ];
+              };
+            };
+            root = {
+              size = "100%";
+              content = {
+                type = "btrfs";
+                extraArgs = [ "-f -L NIXROOT" ];
+                subvolumes = {
+                  "@" = {
+                    mountpoint = "/";
+                    mountOptions = [ "compress=zstd" "noatime" "ssd" "discard=async" ];
+                  };
+                  "@home" = {
+                    mountpoint = "/home";
+                    mountOptions = [ "compress=zstd" "noatime" "ssd" "discard=async" ];
+                  };
+                  "@nix" = {
+                    mountpoint = "/nix";
+                    mountOptions = [ "compress=zstd" "noatime" "ssd" "discard=async" ];
+                  };
+                  "@snapshots" = {
+                    mountpoint = "/mnt";
+                    mountOptions = [ "compress=zstd" "noatime" "ssd" "discard=async" ];
+                  };
+                  "@srv" = {
+                    mountpoint = "/srv";
+                    mountOptions = [ "compress=zstd" "noatime" "ssd" "discard=async" ];
+                  };
+                  "@var" = {
+                    mountpoint = "/var";
+                    mountOptions = [ "compress=zstd" "noatime" "ssd" "discard=async" ];
+                  };
+                  "@swap" = {
+                    mountpoint = "/swap";
+                    swap.swapfile.size = "8G";
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}
@@ -0,0 +1,75 @@
+{
+  disko.devices = {
+    disk = {
+      nvme0n1 = {
+        type = "disk";
+        device = "/dev/nvme0n1";
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "512M";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                extraArgs = [ "-n NIXBOOT" ];
+                mountpoint = "/boot";
+                mountOptions = [
+                  "defaults"
+                ];
+              };
+            };
+            luks = {
+              size = "100%";
+              content = {
+                type = "luks";
+                name = "crypted";
+                askPassword = true;
+                # disable settings.keyFile if you want to use interactive password entry
+                #passwordFile = "/tmp/secret.key"; # Interactive
+                settings = {
+                  allowDiscards = true;
+                };
+                content = {
+                  type = "btrfs";
+                  extraArgs = [ "-f -L NIXROOT" ];
+                  subvolumes = {
+                    "@" = {
+                      mountpoint = "/";
+                      mountOptions = [ "compress=zstd" "noatime" "ssd" "discard=async" ];
+                    };
+                    "@home" = {
+                      mountpoint = "/home";
+                      mountOptions = [ "compress=zstd" "noatime" "ssd" "discard=async" ];
+                    };
+                    "@nix" = {
+                      mountpoint = "/nix";
+                      mountOptions = [ "compress=zstd" "noatime" "ssd" "discard=async" ];
+                    };
+                    "@snapshots" = {
+                      mountpoint = "/mnt";
+                      mountOptions = [ "compress=zstd" "noatime" "ssd" "discard=async" ];
+                    };
+                    "@srv" = {
+                      mountpoint = "/srv";
+                      mountOptions = [ "compress=zstd" "noatime" "ssd" "discard=async" ];
+                    };
+                    "@var" = {
+                      mountpoint = "/var";
+                      mountOptions = [ "compress=zstd" "noatime" "ssd" "discard=async" ];
+                    };
+                    "@swap" = {
+                      mountpoint = "/swap";
+                      swap.swapfile.size = "8G";
+                    };
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}
@@ -0,0 +1,47 @@
+{
+  disko.devices = {
+    disk = {
+      sda = {
+        type = "disk";
+        device = "/dev/sda";
+        content = {
+          type = "gpt";
+          partitions = {
+            luks = {
+              size = "100%";
+              content = {
+                type = "luks";
+                name = "NAS-RAID";
+                askPassword = true;
+                # disable settings.keyFile if you want to use interactive password entry
+                #passwordFile = "/tmp/secret.key"; # Interactive
+                settings = {
+                  allowDiscards = true;
+                };
+                content = {
+                  type = "btrfs";
+                  extraArgs = [ "-f -L NAS-RAID" ];
+                  subvolumes = {
+                    "@" = {
+                      mountpoint = "/mnt/Pluto";
+                      mountOptions = [ "compress=zstd" "noatime" "ssd" "discard=async" ];
+                    };
+                    "@/Backups";
+                    "@/Media";
+                    "@/Games";
+                    "@/IT";
+                    "@/Rest";
+                    "@snapshots" = {
+                      mountpoint = "/mnt";
+                      mountOptions = [ "compress=zstd" "noatime" "ssd" "discard=async" ];
+                    };
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}
@@ -6,14 +6,15 @@
        "home-manager": "home-manager",
        "nixpkgs": [
          "nixpkgs"
-        ]
+        ],
+        "systems": "systems"
      },
      "locked": {
-        "lastModified": 1701216516,
-        "narHash": "sha256-jKSeJn+7hZ1dZdiH1L+NWUGT2i/BGomKAJ54B9kT06Q=",
+        "lastModified": 1715290355,
+        "narHash": "sha256-2T7CHTqBXJJ3ZC6R/4TXTcKoXWHcvubKNj9SfomURnw=",
        "owner": "ryantm",
        "repo": "agenix",
-        "rev": "13ac9ac6d68b9a0896e3d43a082947233189e247",
+        "rev": "8d37c5bdeade12b6479c85acd133063ab53187a0",
        "type": "github"
      },
      "original": {
@@ -22,6 +23,27 @@
        "type": "github"
      }
    },
+    "crane": {
+      "inputs": {
+        "nixpkgs": [
+          "lanzaboote",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1711299236,
+        "narHash": "sha256-6/JsyozOMKN8LUGqWMopKTSiK8N79T8Q+hcxu2KkTXg=",
+        "owner": "ipetkov",
+        "repo": "crane",
+        "rev": "880573f80d09e18a11713f402b9e6172a085449f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ipetkov",
+        "repo": "crane",
+        "type": "github"
+      }
+    },
    "darwin": {
      "inputs": {
        "nixpkgs": [
@@ -30,11 +52,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1673295039,
-        "narHash": "sha256-AsdYgE8/GPwcelGgrntlijMg4t3hLFJFCRF3tL5WVjA=",
+        "lastModified": 1700795494,
+        "narHash": "sha256-gzGLZSiOhf155FW7262kdHo2YDeugp3VuIFb4/GGng0=",
        "owner": "lnl7",
        "repo": "nix-darwin",
-        "rev": "87b9d090ad39b25b2400029c64825fc2a8868943",
+        "rev": "4b9b83d5a92e8c1fbfd8eb27eda375908c11ec4d",
        "type": "github"
      },
      "original": {
@@ -44,16 +66,141 @@
        "type": "github"
      }
    },
-    "flake-utils": {
+    "devshell": {
      "inputs": {
-        "systems": "systems"
+        "flake-utils": "flake-utils_3",
+        "nixpkgs": [
+          "nixvim",
+          "nixpkgs"
+        ]
      },
      "locked": {
-        "lastModified": 1694529238,
-        "narHash": "sha256-zsNZZGTGnMOf9YpHKJqMSsa0dXbfmxeoJ7xHlrt+xmY=",
+        "lastModified": 1713532798,
+        "narHash": "sha256-wtBhsdMJA3Wa32Wtm1eeo84GejtI43pMrFrmwLXrsEc=",
+        "owner": "numtide",
+        "repo": "devshell",
+        "rev": "12e914740a25ea1891ec619bb53cf5e6ca922e40",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "devshell",
+        "type": "github"
+      }
+    },
+    "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-compat_2": {
+      "locked": {
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "revCount": 57,
+        "type": "tarball",
+        "url": "https://api.flakehub.com/f/pinned/edolstra/flake-compat/1.0.1/018afb31-abd1-7bff-a5e4-cff7e18efb7a/source.tar.gz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://flakehub.com/f/edolstra/flake-compat/1.tar.gz"
+      }
+    },
+    "flake-compat_3": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-parts": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "lanzaboote",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1709336216,
+        "narHash": "sha256-Dt/wOWeW6Sqm11Yh+2+t0dfEWxoMxGBvv3JpIocFl9E=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "f7b3c975cf067e56e7cda6cb098ebe3fb4d74ca2",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-parts_2": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "nixvim",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1715865404,
+        "narHash": "sha256-/GJvTdTpuDjNn84j82cU6bXztE0MSkdnTWClUCRub78=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "8dc45382d5206bd292f9c2768b8058a8fd8311d9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-root": {
+      "locked": {
+        "lastModified": 1713493429,
+        "narHash": "sha256-ztz8JQkI08tjKnsTpfLqzWoKFQF4JGu2LRz8bkdnYUk=",
+        "owner": "srid",
+        "repo": "flake-root",
+        "rev": "bc748b93b86ee76e2032eecda33440ceb2532fcd",
+        "type": "github"
+      },
+      "original": {
+        "owner": "srid",
+        "repo": "flake-root",
+        "type": "github"
+      }
+    },
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems_2"
+      },
+      "locked": {
+        "lastModified": 1710146030,
+        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
        "owner": "numtide",
        "repo": "flake-utils",
-        "rev": "ff7b65b44d01cf9ba6a71320833626af21126384",
+        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
        "type": "github"
      },
      "original": {
@@ -62,6 +209,86 @@
        "type": "github"
      }
    },
+    "flake-utils_2": {
+      "inputs": {
+        "systems": "systems_3"
+      },
+      "locked": {
+        "lastModified": 1705309234,
+        "narHash": "sha256-uNRRNRKmJyCRC/8y1RqBkqWBLM034y4qN7EprSdmgyA=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "1ef2e671c3b0c19053962c07dbda38332dcebf26",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_3": {
+      "inputs": {
+        "systems": "systems_4"
+      },
+      "locked": {
+        "lastModified": 1701680307,
+        "narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "4022d587cbbfd70fe950c1e2083a02621806a725",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "gitignore": {
+      "inputs": {
+        "nixpkgs": [
+          "lanzaboote",
+          "pre-commit-hooks-nix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1709087332,
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "type": "github"
+      }
+    },
+    "gitignore_2": {
+      "inputs": {
+        "nixpkgs": [
+          "nixvim",
+          "pre-commit-hooks",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1709087332,
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "type": "github"
+      }
+    },
    "home-manager": {
      "inputs": {
        "nixpkgs": [
@@ -70,11 +297,31 @@
        ]
      },
      "locked": {
-        "lastModified": 1682203081,
-        "narHash": "sha256-kRL4ejWDhi0zph/FpebFYhzqlOBrk0Pl3dzGEKSAlEw=",
+        "lastModified": 1703113217,
+        "narHash": "sha256-7ulcXOk63TIT2lVDSExj7XzFx09LpdSAPtvgtM7yQPE=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "32d3e39c491e2f91152c84f8ad8b003420eab0a1",
+        "rev": "3bfaacf46133c037bb356193bd2f1765d9dc82c1",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
+    "home-manager-unstable": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs-unstable"
+        ]
+      },
+      "locked": {
+        "lastModified": 1715930644,
+        "narHash": "sha256-W9pyM3/vePxrffHtzlJI6lDS3seANQ+Nqp+i58O46LI=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "e3ad5108f54177e6520535768ddbf1e6af54b59d",
        "type": "github"
      },
      "original": {
@@ -90,11 +337,33 @@
        ]
      },
      "locked": {
-        "lastModified": 1701433070,
-        "narHash": "sha256-Gf9JStfENaUQ7YWFz3V7x/srIwr4nlnVteqaAxtwpgM=",
+        "lastModified": 1715381426,
+        "narHash": "sha256-wPuqrAQGdv3ISs74nJfGb+Yprm23U/rFpcHFFNWgM94=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "4a8545f5e737a6338814a4676dc8e18c7f43fc57",
+        "rev": "ab5542e9dbd13d0100f8baae2bc2d68af901f4b4",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "ref": "release-23.11",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
+    "home-manager_3": {
+      "inputs": {
+        "nixpkgs": [
+          "nixvim",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1715930644,
+        "narHash": "sha256-W9pyM3/vePxrffHtzlJI6lDS3seANQ+Nqp+i58O46LI=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "e3ad5108f54177e6520535768ddbf1e6af54b59d",
        "type": "github"
      },
      "original": {
@@ -103,36 +372,83 @@
        "type": "github"
      }
    },
-    "jovian-nixos": {
-      "flake": false,
+    "impermanence": {
      "locked": {
-        "lastModified": 1701524494,
-        "narHash": "sha256-dXNCIUWm8Z74PijQ/THFb3HXQtRc2VA6LJvT+VrjZoY=",
+        "lastModified": 1708968331,
+        "narHash": "sha256-VUXLaPusCBvwM3zhGbRIJVeYluh2uWuqtj4WirQ1L9Y=",
+        "owner": "nix-community",
+        "repo": "impermanence",
+        "rev": "a33ef102a02ce77d3e39c25197664b7a636f9c30",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "impermanence",
+        "type": "github"
+      }
+    },
+    "jovian-nixos": {
+      "inputs": {
+        "nix-github-actions": "nix-github-actions",
+        "nixpkgs": [
+          "nixpkgs-unstable"
+        ]
+      },
+      "locked": {
+        "lastModified": 1716107076,
+        "narHash": "sha256-aB15oIMUv6N/UFsLHzgcGRUvU4YfOjE3gEirIP/k82s=",
        "owner": "Jovian-Experiments",
        "repo": "Jovian-NixOS",
-        "rev": "365027ec7dc32018b20d3fbe3abf645406651e4c",
+        "rev": "e8de93b7b4c384650977a20c1f192e23c6e7a12f",
        "type": "github"
      },
      "original": {
        "owner": "Jovian-Experiments",
-        "ref": "development",
        "repo": "Jovian-NixOS",
        "type": "github"
      }
    },
+    "lanzaboote": {
+      "inputs": {
+        "crane": "crane",
+        "flake-compat": "flake-compat",
+        "flake-parts": "flake-parts",
+        "flake-utils": "flake-utils",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "pre-commit-hooks-nix": "pre-commit-hooks-nix",
+        "rust-overlay": "rust-overlay"
+      },
+      "locked": {
+        "lastModified": 1713369831,
+        "narHash": "sha256-G4OGxvlIIjphpkxcRAkf1QInYsAeqbfNh6Yl1JLy2uM=",
+        "owner": "nix-community",
+        "repo": "lanzaboote",
+        "rev": "850f27322239f8cfa56b122cc9a278ab99a49015",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "ref": "master",
+        "repo": "lanzaboote",
+        "type": "github"
+      }
+    },
    "microvm": {
      "inputs": {
-        "flake-utils": "flake-utils",
+        "flake-utils": "flake-utils_2",
        "nixpkgs": [
          "nixpkgs"
-        ]
+        ],
+        "spectrum": "spectrum"
      },
      "locked": {
-        "lastModified": 1701202812,
-        "narHash": "sha256-ym/Rd4tR4i2d1WdPNKaeeIz/UoyfnCe5UBZbUl1M0PM=",
+        "lastModified": 1715787097,
+        "narHash": "sha256-TPp2j0ttvBvkk4oXidvo8Y071zEab0BtcNsC3ZEkluI=",
        "owner": "astro",
        "repo": "microvm.nix",
-        "rev": "89bb7a5230a4820736a43e058c8d2a2c560d672b",
+        "rev": "fa673bf8656fe6f28253b83971a36999bc9995d2",
        "type": "github"
      },
      "original": {
@@ -141,13 +457,56 @@
        "type": "github"
      }
    },
+    "nix-darwin": {
+      "inputs": {
+        "nixpkgs": [
+          "nixvim",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1715901937,
+        "narHash": "sha256-eMyvWP56ZOdraC2IOvZo0/RTDcrrsqJ0oJWDC76JTak=",
+        "owner": "lnl7",
+        "repo": "nix-darwin",
+        "rev": "ffc01182f90118119930bdfc528c1ee9a39ecef8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "lnl7",
+        "repo": "nix-darwin",
+        "type": "github"
+      }
+    },
+    "nix-github-actions": {
+      "inputs": {
+        "nixpkgs": [
+          "jovian-nixos",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1690328911,
+        "narHash": "sha256-fxtExYk+aGf2YbjeWQ8JY9/n9dwuEt+ma1eUFzF8Jeo=",
+        "owner": "zhaofengli",
+        "repo": "nix-github-actions",
+        "rev": "96df4a39c52f53cb7098b923224d8ce941b64747",
+        "type": "github"
+      },
+      "original": {
+        "owner": "zhaofengli",
+        "ref": "matrix-name",
+        "repo": "nix-github-actions",
+        "type": "github"
+      }
+    },
    "nixos-hardware": {
      "locked": {
-        "lastModified": 1701250978,
-        "narHash": "sha256-ohu3cz4edjpGxs2qUTgbs0WrnewOX4crnUJNEB6Jox4=",
+        "lastModified": 1716034089,
+        "narHash": "sha256-QBfab6V4TeQ6Y4NiXVrEATdQuhCNFNaXt/L1K/Zw+zc=",
        "owner": "NixOS",
        "repo": "nixos-hardware",
-        "rev": "8772491ed75f150f02552c60694e1beff9f46013",
+        "rev": "b55712de78725c8fcde422ee0a0fe682046e73c3",
        "type": "github"
      },
      "original": {
@@ -159,11 +518,43 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1701253981,
-        "narHash": "sha256-ztaDIyZ7HrTAfEEUt9AtTDNoCYxUdSd6NrRHaYOIxtk=",
+        "lastModified": 1716061101,
+        "narHash": "sha256-H0eCta7ahEgloGIwE/ihkyGstOGu+kQwAiHvwVoXaA0=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "e7cc61784ddf51c81487637b3031a6dd2d6673a2",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-23.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs-stable": {
+      "locked": {
+        "lastModified": 1710695816,
+        "narHash": "sha256-3Eh7fhEID17pv9ZxrPwCLfqXnYP006RKzSs0JptsN84=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "614b4613980a522ba49f0d194531beddbb7220d3",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-23.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs-unstable": {
+      "locked": {
+        "lastModified": 1715961556,
+        "narHash": "sha256-+NpbZRCRisUHKQJZF3CT+xn14ZZQO+KjxIIanH3Pvn4=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "e92039b55bcd58469325ded85d4f58dd5a4eaf58",
+        "rev": "4a6b83b05df1a8bd7d99095ec4b4d271f2956b64",
        "type": "github"
      },
      "original": {
@@ -173,34 +564,89 @@
        "type": "github"
      }
    },
-    "nixpkgs-stable": {
+    "nixvim": {
+      "inputs": {
+        "devshell": "devshell",
+        "flake-compat": "flake-compat_2",
+        "flake-parts": "flake-parts_2",
+        "flake-root": "flake-root",
+        "home-manager": "home-manager_3",
+        "nix-darwin": "nix-darwin",
+        "nixpkgs": [
+          "nixpkgs-unstable"
+        ],
+        "pre-commit-hooks": "pre-commit-hooks",
+        "treefmt-nix": "treefmt-nix"
+      },
      "locked": {
-        "lastModified": 1701362232,
-        "narHash": "sha256-GVdzxL0lhEadqs3hfRLuj+L1OJFGiL/L7gCcelgBlsw=",
-        "owner": "NixOS",
-        "repo": "nIxpkgs",
-        "rev": "d2332963662edffacfddfad59ff4f709dde80ffe",
+        "lastModified": 1716125991,
+        "narHash": "sha256-PmB9vmp383foiVi64RawbnkC+6SiYiWUjdzw2xgl3eM=",
+        "owner": "nix-community",
+        "repo": "nixvim",
+        "rev": "88ade1dfaa017499326103a078c66dd5d4d0606e",
        "type": "github"
      },
      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-23.05",
-        "repo": "nIxpkgs",
+        "owner": "nix-community",
+        "repo": "nixvim",
        "type": "github"
      }
    },
-    "nur": {
+    "pre-commit-hooks": {
+      "inputs": {
+        "flake-compat": "flake-compat_3",
+        "gitignore": "gitignore_2",
+        "nixpkgs": [
+          "nixvim",
+          "nixpkgs"
+        ],
+        "nixpkgs-stable": [
+          "nixvim",
+          "nixpkgs"
+        ]
+      },
      "locked": {
-        "lastModified": 1701546128,
-        "narHash": "sha256-EgKJ0kQ/VFbDFhBeiRtuxQOtdY+p+8/3u/uNrEeQvV8=",
-        "owner": "nix-community",
-        "repo": "NUR",
-        "rev": "ce93686dc874ac9e17c94d3332ddd8d95bd19b6e",
+        "lastModified": 1715870890,
+        "narHash": "sha256-nacSOeXtUEM77Gn0G4bTdEOeFIrkCBXiyyFZtdGwuH0=",
+        "owner": "cachix",
+        "repo": "pre-commit-hooks.nix",
+        "rev": "fa606cccd7b0ccebe2880051208e4a0f61bfc8c1",
        "type": "github"
      },
      "original": {
-        "owner": "nix-community",
-        "repo": "NUR",
+        "owner": "cachix",
+        "repo": "pre-commit-hooks.nix",
+        "type": "github"
+      }
+    },
+    "pre-commit-hooks-nix": {
+      "inputs": {
+        "flake-compat": [
+          "lanzaboote",
+          "flake-compat"
+        ],
+        "flake-utils": [
+          "lanzaboote",
+          "flake-utils"
+        ],
+        "gitignore": "gitignore",
+        "nixpkgs": [
+          "lanzaboote",
+          "nixpkgs"
+        ],
+        "nixpkgs-stable": "nixpkgs-stable"
+      },
+      "locked": {
+        "lastModified": 1710923068,
+        "narHash": "sha256-6hOpUiuxuwpXXc/xfJsBUJeqqgGI+JMJuLo45aG3cKc=",
+        "owner": "cachix",
+        "repo": "pre-commit-hooks.nix",
+        "rev": "e611897ddfdde3ed3eaac4758635d7177ff78673",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "pre-commit-hooks.nix",
        "type": "github"
      }
    },
@@ -208,12 +654,56 @@
      "inputs": {
        "agenix": "agenix",
        "home-manager": "home-manager_2",
+        "home-manager-unstable": "home-manager-unstable",
+        "impermanence": "impermanence",
        "jovian-nixos": "jovian-nixos",
+        "lanzaboote": "lanzaboote",
        "microvm": "microvm",
        "nixos-hardware": "nixos-hardware",
        "nixpkgs": "nixpkgs",
-        "nixpkgs-stable": "nixpkgs-stable",
-        "nur": "nur"
+        "nixpkgs-unstable": "nixpkgs-unstable",
+        "nixvim": "nixvim"
+      }
+    },
+    "rust-overlay": {
+      "inputs": {
+        "flake-utils": [
+          "lanzaboote",
+          "flake-utils"
+        ],
+        "nixpkgs": [
+          "lanzaboote",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1711246447,
+        "narHash": "sha256-g9TOluObcOEKewFo2fR4cn51Y/jSKhRRo4QZckHLop0=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "dcc802a6ec4e9cc6a1c8c393327f0c42666f22e4",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    },
+    "spectrum": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1708358594,
+        "narHash": "sha256-e71YOotu2FYA67HoC/voJDTFsiPpZNRwmiQb4f94OxQ=",
+        "ref": "refs/heads/main",
+        "rev": "6d0e73864d28794cdbd26ab7b37259ab0e1e044c",
+        "revCount": 614,
+        "type": "git",
+        "url": "https://spectrum-os.org/git/spectrum"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://spectrum-os.org/git/spectrum"
      }
    },
    "systems": {
@@ -230,6 +720,72 @@
        "repo": "default",
        "type": "github"
      }
+    },
+    "systems_2": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_3": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_4": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "treefmt-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixvim",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1715940852,
+        "narHash": "sha256-wJqHMg/K6X3JGAE9YLM0LsuKrKb4XiBeVaoeMNlReZg=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "2fba33a182602b9d49f0b2440513e5ee091d838b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
+      }
    }
  },
  "root": "root",
@@ -11,19 +11,25 @@

  inputs =                                                                  # All flake references used to build my NixOS setup. These are dependencies.
    {
-      nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";                  # Nix Packages
-      nixpkgs-stable.url = "github:NixOS/nIxpkgs/nixos-23.05";
+      nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable";                  # Nix Packages
+      nixpkgs.url = "github:NixOS/nixpkgs/nixos-23.11";
      nixos-hardware.url = "github:NixOS/nixos-hardware/master";
-      microvm.url = "github:astro/microvm.nix";
-      microvm.inputs.nixpkgs.follows = "nixpkgs";

-      home-manager = {                                                      # User Package Management
-        url = "github:nix-community/home-manager";
+      microvm = {
+        url = "github:astro/microvm.nix";
        inputs.nixpkgs.follows = "nixpkgs";
      };

-      nur = {
-        url = "github:nix-community/NUR";                                   # NUR Packages
+      impermanence.url = "github:nix-community/impermanence";
+
+      home-manager = {                                                      # User Package Management
+        url = "github:nix-community/home-manager/release-23.11";
+        inputs.nixpkgs.follows = "nixpkgs";
+      };
+
+      home-manager-unstable = {                                                      # User Package Management
+        url = "github:nix-community/home-manager";
+        inputs.nixpkgs.follows = "nixpkgs-unstable";
      };

      agenix = {
@@ -32,12 +38,22 @@
      };

      jovian-nixos = {
-          url = "github:Jovian-Experiments/Jovian-NixOS/development";
-          flake = false;
+          url = "github:Jovian-Experiments/Jovian-NixOS";
+          inputs.nixpkgs.follows = "nixpkgs-unstable";
      };
+
+      lanzaboote = {
+          url = "github:nix-community/lanzaboote/master";
+          inputs.nixpkgs.follows = "nixpkgs";
+       };
+
+       nixvim = {
+           url = "github:nix-community/nixvim";
+           inputs.nixpkgs.follows = "nixpkgs-unstable";
+       };
    };

-  outputs = inputs @ { self, nixpkgs, nixpkgs-stable, nixos-hardware, home-manager, nur, agenix, jovian-nixos, microvm, ... }:   # Function that tells my flake which to use and what do what to do with the dependencies.
+  outputs = inputs @ { self, nixpkgs, nixpkgs-unstable, nixos-hardware, home-manager, home-manager-unstable, agenix, jovian-nixos, microvm, impermanence, lanzaboote, nixvim, ... }:   # Function that tells my flake which to use and what do what to do with the dependencies.
    let                                                                     # Variables that can be used in the config files
      user = "kabbone";
      userdmz = "diablo";
@@ -48,10 +64,11 @@
      nixosConfigurations = (                                               # NixOS configurations
        import ./hosts {                                                    # Imports ./hosts/default.nix
          inherit (nixpkgs) lib;
-          inherit inputs nixpkgs nixpkgs-stable nixos-hardware home-manager nur user userdmz userserver location agenix jovian-nixos microvm;   # Also inherit home-manager so it does not need to be defined here.
+          inherit inputs nixpkgs nixpkgs-unstable nixos-hardware home-manager home-manager-unstable user userdmz userserver location agenix jovian-nixos microvm impermanence lanzaboote nixvim;   # Also inherit home-manager so it does not need to be defined here.
          nix.allowedUsers = [ "@wheel" ];
          security.sudo.execWheelOnly = true;
        }
      );
    };
+
 }
@@ -69,12 +69,11 @@
    carlito                                 # NixOS
    vegur                                   # NixOS
    source-code-pro
-    jetbrains-mono
    font-awesome                            # Icons
    hack-font
    corefonts                               # MS
    intel-one-mono
-    office-code-pro
+    cascadia-code
    (nerdfonts.override {                   # Nerdfont Icons override
      fonts = [
        "FiraCode"
@@ -115,6 +114,8 @@
      tree
      direnv
      linuxPackages_latest.cpupower
+      btop
+      sbctl
    ];
  };

@@ -176,25 +177,24 @@
      options = "--delete-older-than 7d";
    };
    package = pkgs.nixVersions.stable;               # Enable nixFlakes on system
-    registry.nixpkgs.flake = inputs.nixpkgs;
    extraOptions = ''
      experimental-features = nix-command flakes
-      keep-outputs          = true
-      keep-derivations      = true
    '';
  };
  nixpkgs.config.allowUnfree = true;        # Allow proprietary software.
-  nixpkgs.config.packageOverrides = pkgs: {
-    nur = import (builtins.fetchTarball "https://github.com/nix-community/NUR/archive/master.tar.gz") {
-      inherit pkgs;
-    };
-  };

  system = {                                # NixOS settings
-#    autoUpgrade = {                         # Allow auto update
-#      enable = true;
-#      channel = "https://nixos.org/channels/nixos-unstable";
-#    };
+    autoUpgrade = {                         # Allow auto update
+      enable = true;
+      flake = "git+https://git.kabtop.de/Kabbone/nixos-config";
+      randomizedDelaySec = "5m";
+      allowReboot = true;
+      rebootWindow = {
+          lower = "02:00";
+          upper = "05:00";
+      };
+      #channel = "https://nixos.org/channels/nixos-unstable";
+    };
    stateVersion = "23.05";
  };
 }
@@ -58,7 +58,7 @@
    carlito                                 # NixOS
    vegur                                   # NixOS
    source-code-pro
-    jetbrains-mono
+    cascadia-code
    font-awesome                            # Icons
    hack-font
    corefonts                               # MS
@@ -94,6 +94,9 @@
      powerline-fonts
      powerline-symbols
      tree
+      btop
+      htop
+      direnv
    ];
  };

@@ -122,7 +125,6 @@
      options = "--delete-older-than 7d";
    };
    package = pkgs.nixVersions.stable;               # Enable nixFlakes on system
-    registry.nixpkgs.flake = inputs.nixpkgs;
    extraOptions = ''
      experimental-features = nix-command flakes
      keep-outputs          = true
@@ -130,17 +132,18 @@
    '';
  };
  nixpkgs.config.allowUnfree = true;        # Allow proprietary software.
-  nixpkgs.config.packageOverrides = pkgs: {
-    nur = import (builtins.fetchTarball "https://github.com/nix-community/NUR/archive/master.tar.gz") {
-      inherit pkgs;
-    };
-  };

  system = {                                # NixOS settings
-#    autoUpgrade = {                         # Allow auto update
-#      enable = true;
-#      channel = "https://nixos.org/channels/nixos-unstable";
-#    };
-    stateVersion = "22.05";
+    autoUpgrade = {                         # Allow auto update
+      enable = true;
+      flake = "git+https://git.kabtop.de/Kabbone/nixos-config";
+      randomizedDelaySec = "5m";
+      allowReboot = true;
+      rebootWindow = {
+          lower = "02:00";
+          upper = "05:00";
+      };
+    };
+    stateVersion = "23.05";
  };
 }
@@ -11,7 +11,7 @@
 #            └─ ./home.nix 
 #

-{ lib, inputs, nixpkgs, nixos-hardware, home-manager, nur, user, userdmz, userserver, location, agenix, jovian-nixos, microvm, ... }:
+{ lib, inputs, nixpkgs, nixpkgs-unstable, nixos-hardware, home-manager, home-manager-unstable, user, userdmz, userserver, location, agenix, jovian-nixos, microvm, impermanence, lanzaboote, nixvim, ... }:

 let
  system = "x86_64-linux";                                  # System architecture
@@ -28,11 +28,12 @@ in
 {
  desktop = lib.nixosSystem {                                # Desktop profile
    inherit system;
-    specialArgs = { inherit inputs user location nixos-hardware nur agenix microvm nixpkgs; };
+    specialArgs = { inherit inputs user location nixos-hardware agenix microvm nixpkgs lanzaboote nixvim; };
    modules = [
      agenix.nixosModules.default
-      nur.nixosModules.nur
      microvm.nixosModules.host
+      lanzaboote.nixosModules.lanzaboote
+      #nixvim.nixosModules.nixvim
      ./desktop
      ./configuration_desktop.nix
      ../modules/hardware/remoteBuilder.nix
@@ -42,9 +43,6 @@ in
      

      home-manager.nixosModules.home-manager {
-          nixpkgs.overlays = [
-            nur.overlay
-          ];
        home-manager.useGlobalPkgs = true;
        home-manager.useUserPackages = true;
        home-manager.extraSpecialArgs = { inherit user; };
@@ -57,10 +55,9 @@ in

  laptop = lib.nixosSystem {                                # Laptop profile
    inherit system;
-    specialArgs = { inherit inputs user location nixos-hardware nur agenix; };
+    specialArgs = { inherit inputs user location nixos-hardware agenix; };
    modules = [
      agenix.nixosModules.default
-      nur.nixosModules.nur
      ./laptop
      ./configuration_desktop.nix
      ../modules/hardware/remoteClient.nix
@@ -69,9 +66,6 @@ in
      nixos-hardware.nixosModules.common-pc-ssd

      home-manager.nixosModules.home-manager {
-          nixpkgs.overlays = [
-            nur.overlay
-          ];
        home-manager.useGlobalPkgs = true;
        home-manager.useUserPackages = true;
        home-manager.extraSpecialArgs = { inherit user; };
@@ -82,12 +76,13 @@ in
    ];
  };

-  steamdeck = lib.nixosSystem {                                # Laptop profile
+  steamdeck = nixpkgs-unstable.lib.nixosSystem {            # steamdeck profile
    inherit system;
-    specialArgs = { inherit inputs user location nixos-hardware nur agenix jovian-nixos; };
+    specialArgs = { inherit inputs user location nixos-hardware agenix jovian-nixos lanzaboote; };
    modules = [
      agenix.nixosModules.default
-      nur.nixosModules.nur
+      jovian-nixos.nixosModules.default
+      lanzaboote.nixosModules.lanzaboote
      ./steamdeck
      ./configuration_desktop.nix
      ../modules/hardware/remoteClient.nix
@@ -95,10 +90,7 @@ in
      nixos-hardware.nixosModules.common-gpu-amd
      nixos-hardware.nixosModules.common-pc-ssd

-      home-manager.nixosModules.home-manager {
-          nixpkgs.overlays = [
-            nur.overlay
-          ];
+      home-manager-unstable.nixosModules.home-manager {
        home-manager.useGlobalPkgs = true;
        home-manager.useUserPackages = true;
        home-manager.extraSpecialArgs = { inherit user; };
@@ -111,19 +103,16 @@ in

  server = lib.nixosSystem {                                # Desktop profile
    inherit system;
-    specialArgs = { inherit inputs user location nixos-hardware nur agenix; };
+    specialArgs = { inherit inputs user location nixos-hardware agenix nixpkgs impermanence; };
    modules = [
      agenix.nixosModules.default
-      nur.nixosModules.nur
+      microvm.nixosModules.host
      ./server
      ./configuration_server.nix
      nixos-hardware.nixosModules.common-cpu-amd
      nixos-hardware.nixosModules.common-pc-ssd

      home-manager.nixosModules.home-manager {
-          nixpkgs.overlays = [
-            nur.overlay
-          ];
        home-manager.useGlobalPkgs = true;
        home-manager.useUserPackages = true;
        home-manager.extraSpecialArgs = { inherit user; };
@@ -134,38 +123,33 @@ in
    ];
  };

-  dmz = lib.nixosSystem {                                # Desktop profile
+  kabtop = lib.nixosSystem {                                # Desktop profile
    inherit system;
-    specialArgs = { inherit inputs user location nixos-hardware nur agenix nixpkgs; };
+    specialArgs = { inherit inputs user location nixos-hardware agenix nixpkgs impermanence; };
    modules = [
      agenix.nixosModules.default
-      nur.nixosModules.nur
      microvm.nixosModules.host
-      ./dmz
+      ./kabtop
      ./configuration_server.nix
+      nixos-hardware.nixosModules.common-cpu-amd
      nixos-hardware.nixosModules.common-pc-ssd

      home-manager.nixosModules.home-manager {
-          nixpkgs.overlays = [
-            nur.overlay
-          ];
        home-manager.useGlobalPkgs = true;
        home-manager.useUserPackages = true;
        home-manager.extraSpecialArgs = { inherit user; };
        home-manager.users.${user} = {
-        imports = [(import ./home_server.nix)] ++ [(import ./dmz/home.nix)];
+        imports = [(import ./home_server.nix)] ++ [(import ./server/home.nix)];
        };
      }
    ];
  };

-  nasbackup = lib.nixosSystem {                                # Desktop profile
+  nasbak = lib.nixosSystem {                                # Desktop profile
    inherit system;
-    #user = "dmz-user";
-    specialArgs = { inherit inputs user location nixos-hardware nur agenix; };
+    specialArgs = { inherit inputs user location nixos-hardware agenix; };
    modules = [
      agenix.nixosModules.default
-      nur.nixosModules.nur
      ./nasbackup
      ./configuration_desktop.nix
      ../modules/hardware/remoteClient.nix
@@ -173,9 +157,6 @@ in
      nixos-hardware.nixosModules.common-pc-ssd

      home-manager.nixosModules.home-manager {
-          nixpkgs.overlays = [
-            nur.overlay
-          ];
        home-manager.useGlobalPkgs = true;
        home-manager.useUserPackages = true;
        home-manager.extraSpecialArgs = { inherit user; };
@@ -188,10 +169,9 @@ in

  jupiter = lib.nixosSystem {                                # Desktop profile
    inherit system;
-    specialArgs = { inherit inputs user location nixos-hardware nur agenix; };
+    specialArgs = { inherit inputs user location nixos-hardware agenix; };
    modules = [
      agenix.nixosModules.default
-      nur.nixosModules.nur
      ./jupiter
      ./configuration_desktop.nix
      ../modules/hardware/remoteClient.nix
@@ -199,9 +179,6 @@ in
      nixos-hardware.nixosModules.common-pc-ssd

      home-manager.nixosModules.home-manager {
-          nixpkgs.overlays = [
-            nur.overlay
-          ];
        home-manager.useGlobalPkgs = true;
        home-manager.useUserPackages = true;
        home-manager.extraSpecialArgs = { inherit user; };
@@ -212,39 +189,42 @@ in
    ];
  };

-  q920 = lib.nixosSystem {                                # Laptop profile
+  dmz = lib.nixosSystem {                                # Desktop profile
    inherit system;
-    specialArgs = { inherit inputs user location ; };
+    specialArgs = { inherit inputs user location nixos-hardware agenix nixpkgs impermanence; };
    modules = [
-      ./q920
-      ./configuration.nix
+      agenix.nixosModules.default
+      microvm.nixosModules.host
+      ./dmz
+      ./configuration_server.nix
+      nixos-hardware.nixosModules.common-pc-ssd

      home-manager.nixosModules.home-manager {
        home-manager.useGlobalPkgs = true;
        home-manager.useUserPackages = true;
        home-manager.extraSpecialArgs = { inherit user; };
        home-manager.users.${user} = {
-          imports = [(import ./home.nix)] ++ [(import ./q920/home.nix)];
+        imports = [(import ./home_server.nix)] ++ [(import ./dmz/home.nix)];
        };
      }
    ];
  };

-  vm = lib.nixosSystem {                                    # VM profile
-    inherit system;
-    specialArgs = { inherit inputs user location; };
-    modules = [
-      ./vm
-      ./configuration.nix
-
-      home-manager.nixosModules.home-manager {
-        home-manager.useGlobalPkgs = true;
-        home-manager.useUserPackages = true;
-        home-manager.extraSpecialArgs = { inherit user; }; 
-        home-manager.users.${user} = {
-          imports = [(import ./home.nix)] ++ [(import ./vm/home.nix)];
-        };
-      }
-    ];
-  };
+#  vm = lib.nixosSystem {                                    # VM profile
+#    inherit system;
+#    specialArgs = { inherit inputs user location; };
+#    modules = [
+#      ./vm
+#      ./configuration.nix
+#
+#      home-manager.nixosModules.home-manager {
+#        home-manager.useGlobalPkgs = true;
+#        home-manager.useUserPackages = true;
+#        home-manager.extraSpecialArgs = { inherit user; }; 
+#        home-manager.users.${user} = {
+#          imports = [(import ./home.nix)] ++ [(import ./vm/home.nix)];
+#        };
+#      }
+#    ];
+#  };
 }
@@ -17,27 +17,32 @@
 #           └─ default.nix
 #

-{ config, nixpkgs, pkgs, user, ... }:
+{ config, nixpkgs, pkgs, user, lib, nixvim, ... }:

 {
  imports =                                                         # For now, if applying to other system, swap files
    [(import ./hardware-configuration.nix)] ++                      # Current system hardware config @ /etc/nixos/hardware-configuration.nix
-    #[(import ../../modules/desktop/hyprland/default.nix)] ++        # Window Manager
-    [(import ../../modules/desktop/sway/default.nix)] ++        # Window Manager
-    (import ../../modules/desktop/virtualisation) ++   # Docker
-    (import ../../modules/hardware);                                # Hardware devices
+    [(import ../../modules/wm/sway/default.nix)] ++         # Window Manager
+    (import ../../modules/wm/virtualisation) ++             # libvirt + Docker
+    [(import ../../modules/wm/virtualisation/kvm-amd.nix)] ++   # kvm module options
+    (import ../../modules/hardware);                             # Hardware devices

  boot = {                                  # Boot options
    kernelPackages = pkgs.linuxPackages_latest;

    loader = {                              # EFI Boot
-      systemd-boot.enable = true;
+      systemd-boot.enable = lib.mkForce false;
      efi = {
        canTouchEfiVariables = true;
        efiSysMountPoint = "/boot";
      };
      timeout = 1;                          # Grub auto select time
    };
+
+    lanzaboote = {
+        enable = true;
+        pkiBundle = "/etc/secureboot";
+    };
  };

 #  hardware.sane = {                           # Used for scanning with Xsane
@@ -16,8 +16,8 @@
 {
  imports =
    [
-      #../../modules/desktop/hyprland/home.nix # Window Manager
-      ../../modules/desktop/sway/home.nix # Window Manager
+      #../../modules/wm/hyprland/home.nix # Window Manager
+      ../../modules/wm/sway/home.nix # Window Manager
      ../../modules/home.nix # Window Manager
    ];

@@ -35,6 +35,8 @@
      pulsemixer
      #yubioath-flutter
      nitrokey-app
+      kicad
+      yuzu-mainline

      # Display
      #light                              # xorg.xbacklight not supported. Other option is just use xrandr.
@@ -17,12 +17,13 @@
 #           └─ default.nix
 #

-{ config, pkgs, user, agenix, ... }:
+{ config, pkgs, user, agenix, impermanence, ... }:

 {
  imports =                                                         # For now, if applying to other system, swap files
    [(import ./hardware-configuration.nix)] ++                      # Current system hardware config @ /etc/nixos/hardware-configuration.nix
-    [(import ../../modules/desktop/virtualisation/docker.nix)] ++   # Docker
+    [(import ../../modules/wm/virtualisation/docker.nix)] ++   # Docker
+    [(import ../../modules/wm/virtualisation/kvm-intel.nix)] ++   # Docker
    (import ../../modules/services/dmz) ++                       # Server Services
    (import ../../modules/hardware);                                # Hardware devices

@@ -31,13 +31,13 @@

    packages = with pkgs; [
 # Terminal
-      btop              # Resource Manager
      pfetch            # Minimal fetch
      ranger            # File Manager
      gnupg             # sign and authorize 2nd Fac

      xdg-utils
      steam
+      wakelan

 # dev ols
      gcc
@@ -63,11 +63,12 @@
      calibre
      mtpfs
      vimiv-qt
-      #freecad
+      freecad

 # Fileanagement
      #okular            # PDF viewer
      #gnome.file-roller # Archive Manager
+      ark
      pcmanfm           # File Manager
      rsync             # Syncer $ rsync -r dir1/ dir2/
      unzip             # Zip files
@@ -79,7 +80,7 @@
      libreoffice

      # Flatpak
-      super-slicer-latest
+      prusa-slicer
      #vscodium
      (vscode-with-extensions.override {
          vscode = vscodium;
@@ -111,20 +112,20 @@
  };


-  gtk = {                                     # Theming
-    enable = true;
-    theme = {
-      name = "Dracula";
-      package = pkgs.dracula-theme;
-    };
-    iconTheme = {
-      name = "Papirus-Dark";
-      package = pkgs.papirus-icon-theme;
-    };
-    font = {
-      name = "FiraCode Nerd Font";         # or FiraCode Nerd Font Mono Medium
-    };                                        # Cursor is declared under home.pointerCursor
-  };
+#  gtk = {                                     # Theming
+#    enable = true;
+#    theme = {
+#      name = "Dracula";
+#      package = pkgs.dracula-theme;
+#    };
+#    iconTheme = {
+#      name = "Papirus-Dark";
+#      package = pkgs.papirus-icon-theme;
+#    };
+#    font = {
+#      name = "Cascadia Code";         # or FiraCode Nerd Font Mono Medium
+#    };                                        # Cursor is declared under home.pointerCursor
+#  };
  systemd.user.services.mpris-proxy = {
    Unit.Description = "Mpris proxy";
    Unit.After = [ "network.target" "sound.target" ];
@@ -31,7 +31,6 @@

    packages = with pkgs; [
      # Terminal
-      btop              # Resource Manager
      pfetch            # Minimal fetch
      ranger            # File Manager
      gnupg             # sign and authorize 2nd Fac
@@ -22,7 +22,7 @@
 {
  imports =                                                         # For now, if applying to other ssystem, swap files
    [(import ./hardware-configuration.nix)] ++                      # Current system hardware config @ /etc/nixos/hardware-configuration.nix
-    #(import ../../modules/desktop/virtualisation) ++   # Docker
+    #(import ../../modules/wm/virtualisation) ++   # Docker
    (import ../../modules/services/nas) ++                       # Server Services
    (import ../../modules/hardware);                                # Hardware devices

@@ -25,7 +25,11 @@
  };
  boot.initrd.luks.devices = {
    NAS-RAID1 = {
-      device = "/dev/disk/by-uuid/57e6446d-faca-4b67-9063-e8d9afb80088";
+      device = "/dev/disk/by-uuid/78c74410-c840-49b0-8a29-456d60c38217";
+      keyFile = "/root/NASKeyfile";
+    };
+    NAS-RAID1_2 = {
+      device = "/dev/disk/by-uuid/dda6e698-4f0a-4d71-a06c-656b87374ed7";
      keyFile = "/root/NASKeyfile";
    };
  };
@@ -152,13 +156,13 @@
  fileSystems."/mnt/snapshots/Pluto" =
    { device = "/dev/disk/by-label/NAS-RAID";
      fsType = "btrfs";
-      options = [ "compress=zstd,space_cache=v2,noatime,subvolid=5" ];
+      options = [ "compress=zstd:8,noatime,subvolid=5" ];
    };

  fileSystems."/mnt/Pluto" =
    { device = "/dev/disk/by-label/NAS-RAID";
      fsType = "btrfs";
-      options = [ "compress=zstd,space_cache=v2,noatime,subvol=@" ];
+      options = [ "compress=zstd:8,noatime,subvol=@" ];
    };

  fileSystems."/mnt/Mars" =
@@ -0,0 +1,112 @@
+#
+#  Specific system configuration settings for desktop
+#
+#  flake.nix
+#   ├─ ./hosts
+#   │   └─ ./laptop
+#   │        ├─ default.nix *
+#   │        └─ hardware-configuration.nix       
+#   └─ ./modules
+#       ├─ ./desktop
+#       │   └─ ./hyprland
+#       │       └─ hyprland.nix
+#       ├─ ./modules
+#       │   └─ ./programs
+#       │       └─ waybar.nix
+#       └─ ./hardware
+#           └─ default.nix
+#
+
+{ config, pkgs, user, agenix, impermanence, ... }:
+
+{
+  imports =                                                         # For now, if applying to other system, swap files
+    [(import ./hardware-configuration.nix)] ++                      # Current system hardware config @ /etc/nixos/hardware-configuration.nix
+    [(import ../../modules/wm/virtualisation/docker.nix)] ++   # Docker
+    [(import ../../modules/wm/virtualisation/kvm-amd.nix)] ++  # kvm module options
+    (import ../../modules/services/server) ++                       # Server Services
+    (import ../../modules/hardware);                                # Hardware devices
+
+  boot = {                                  # Boot options
+    kernelPackages = pkgs.linuxPackages_latest;
+
+    loader = {                              # EFI Boot
+    grub = {
+        enable = true;
+        device = "/dev/sda";
+    };
+      timeout = 1;                          # Grub auto select time
+    };
+  };
+
+  environment = {
+    etc = {
+      "fail2ban/filter.d/open-webui.conf" = {
+        source = ../../modules/services/server/fail2ban/filter/open-webui.conf;
+        mode = "0444";
+      };
+      "fail2ban/filter.d/gitea.conf" = {
+        source = ../../modules/services/server/fail2ban/filter/gitea.conf;
+        mode = "0444";
+      };
+      "fail2ban/filter.d/nextcloud.conf" = {
+        source = ../../modules/services/server/fail2ban/filter/nextcloud.conf;
+        mode = "0444";
+      };
+    };
+  };
+
+  programs = {                              # No xbacklight, this is the alterantive
+    zsh.enable = true;
+    ssh.startAgent = false;
+    gnupg.agent = {
+      enable = true;
+      enableSSHSupport = true;
+      pinentryFlavor = "curses";
+    };
+  };
+
+  services = {
+    #auto-cpufreq.enable = true;
+    qemuGuest.enable = true;
+    avahi = {                               # Needed to find wireless printer
+      enable = true;
+      nssmdns = true;
+      publish = {                           # Needed for detecting the scanner
+        enable = true;
+        addresses = true;
+        userServices = true;
+      };
+    };
+    fail2ban = {
+        enable = true;
+        maxretry = 5;
+        jails.DEFAULT.settings = {
+           findtime = "15m";
+        };
+        jails = {
+            open-webui = ''
+              enabled = true
+              filter = open-webui
+              backend = systemd
+              action = iptables-allports
+            '';
+            gitea = ''
+              enabled = true
+              filter = gitea
+              backend = systemd
+              action = iptables-allports
+            '';
+            nextcloud = ''
+              backend = auto
+              enabled = true
+              filter = nextcloud
+              logpath = /var/lib/nextcloud/data/nextcloud.log
+              action = iptables-allports
+            '';
+          };
+    };
+
+  };
+
+}
@@ -0,0 +1,144 @@
+#
+# Hardware settings for Teclast F5 10" Laptop
+# NixOS @ sda2
+#
+# flake.nix
+#  └─ ./hosts
+#      └─ ./laptop
+#          └─ hardware-configuration.nix *
+#
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [  "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "ahci" "sd_mod" "sr_mod" ];
+  boot.initrd.kernelModules = [ "vfio_pci" "vfio" "vfio_iommu_type1" ];
+  boot.kernelModules = [ "kvm-amd" ];
+  boot.extraModulePackages = [ ];
+  boot.tmp.useTmpfs = false;
+  boot.tmp.cleanOnBoot = true;
+  zramSwap.enable = true;
+
+  services.btrfs.autoScrub = {
+    enable = true;
+    interval = "monthly";
+    fileSystems = [
+      "/"
+    ];
+  };
+
+  services.btrbk = {
+      instances = {
+          hf = {
+              onCalendar = "hourly";
+              settings = {
+                  incremental = "yes";
+                  snapshot_create = "ondemand";
+                  snapshot_dir = "@snapshots";
+                  timestamp_format = "long";
+
+                  snapshot_preserve = "2m 2w 5d 5h";
+                  snapshot_preserve_min = "latest";
+                
+                  volume =  {
+                      "/mnt/snapshots/root" = {
+                          snapshot_create = "always";
+                          subvolume = {
+                              "@" = {};
+                              "@home" = {};
+                          };
+                      };
+                  };
+              };
+          };
+      };
+  };
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-label/NIXROOT";
+      fsType = "btrfs";
+      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@,discard=async" ];
+    };
+
+  fileSystems."/home" =
+    { device = "/dev/disk/by-label/NIXROOT";
+      fsType = "btrfs";
+      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@home,discard=async" ];
+    };
+
+  fileSystems."/srv" =
+    { device = "/dev/disk/by-label/NIXROOT";
+      fsType = "btrfs";
+      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@srv,discard=async" ];
+    };
+
+  fileSystems."/var" =
+    { device = "/dev/disk/by-label/NIXROOT";
+      fsType = "btrfs";
+      options = [ "space_cache=v2,ssd,noatime,subvol=@var,discard=async" ];
+    };
+
+  fileSystems."/nix" =
+    { device = "/dev/disk/by-label/NIXROOT";
+      fsType = "btrfs";
+      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@nix,discard=async" ];
+    };
+
+  fileSystems."/swap" =
+    { device = "/dev/disk/by-label/NIXROOT";
+      fsType = "btrfs";
+      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@swap,discard=async" ];
+    };
+
+  fileSystems."/mnt/snapshots/root" =
+    { device = "/dev/disk/by-label/NIXROOT";
+      fsType = "btrfs";
+      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvolid=5,discard=async" ];
+    };
+
+
+  #swapDevices = [ { device = "/swap/swapfile"; } ];
+  swapDevices = [  ];
+  
+  networking = {
+    useDHCP = false;                        # Deprecated
+    hostName = "kabtop";
+    domain = "kabtop.de";
+    networkmanager = {
+      enable = false;
+    };
+    interfaces = {
+      ens18 = {
+        useDHCP = false;                     # For versatility sake, manually edit IP on nm-applet.
+        ipv4.addresses = [ {
+            address = "37.44.215.182";
+            prefixLength = 24;
+        } ];
+        ipv6.addresses = [ {
+            address = "2a13:7e80:0:ef::2";
+            prefixLength = 64;
+        } ];
+      };
+    };
+    defaultGateway = "37.44.215.1";
+    defaultGateway6 = {
+      address = "fe80::1";
+      interface = "ens18";
+    };
+
+    nameservers = [ "9.9.9.9" "2620:fe::fe" ];
+    firewall = {
+      enable = true;
+      allowedUDPPorts = [  ];
+      allowedTCPPorts = [ 80 443 ];
+    };
+  };
+
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}
@@ -16,19 +16,18 @@
 {
  imports =
    [
-      ../../modules/desktop/hyprland/home.nix # Window Manager
+      ../../modules/home.nix # Window Manager
    ];

  home = {                                # Specific packages for laptop
    packages = with pkgs; [
      # Applications
-      libreoffice                         # Office packages

      # Display
      #light                              # xorg.xbacklight not supported. Other option is just use xrandr.

      # Power Management
-      auto-cpufreq                       # Power management
+      #auto-cpufreq                       # Power management
      #tlp                                # Power management
    ];
  };
@@ -37,14 +36,4 @@
    alacritty.settings.font.size = 11;
  };

-  services = {                            # Applets
-    blueman-applet.enable = true;         # Bluetooth
-    network-manager-applet.enable = true; # Network
-#   cbatticon = {
-#     enable = true;
-#     criticalLevelPercent = 10;
-#     lowLevelPercent = 20;
-#     iconType = null;
-#   };
-  };
 }
@@ -22,9 +22,10 @@
 {
  imports =                                                         # For now, if applying to other system, swap files
    [(import ./hardware-configuration.nix)] ++                      # Current system hardware config @ /etc/nixos/hardware-configuration.nix
-    #[(import ../../modules/desktop/hyprland/default.nix)] ++        # Window Manager
-    [(import ../../modules/desktop/sway/default.nix)] ++        # Window Manager
-    [(import ../../modules/desktop/virtualisation/docker.nix)] ++   # Docker
+    #[(import ../../modules/wm/hyprland/default.nix)] ++        # Window Manager
+    [(import ../../modules/wm/sway/default.nix)] ++        # Window Manager
+    [(import ../../modules/wm/virtualisation/docker.nix)] ++   # Docker
+    [(import ../../modules/wm/virtualisation/kvm-intel.nix)] ++   # kvm module options
    (import ../../modules/hardware);                                # Hardware devices

  boot = {                                  # Boot options
@@ -57,6 +58,7 @@
  };

  programs = {                              # No xbacklight, this is the alterantive
+    zsh.enable = true;
    dconf.enable = true;
    light.enable = true;
    ssh.startAgent = false;
@@ -17,24 +17,29 @@
    [ (modulesPath + "/installer/scan/not-detected.nix")
    ];

-  boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "usb_storage" "usbhid" "sd_mod" "sdhci_pci" "rtsx_usb_sdmmc" ];
-  boot.initrd.kernelModules = [ "i915" "kvm_intel" ];
-  boot.kernelModules = [ "kvm-intel" ];
-  boot.extraModprobeConfig = ''
-      options i915 enable_guc=3 enable_fbc=1 fastboot=1
-      '';
-  boot.kernelParams = [ "mitigations=off" "luks.options=fido2-device=auto" ];
-  boot.tmp.useTmpfs = true;
-  zramSwap.enable = true;
+  boot = {
+	  initrd = {
+		  availableKernelModules = [ "ahci" "xhci_pci" "usb_storage" "usbhid" "sd_mod" "sdhci_pci" "rtsx_usb_sdmmc" ];
+		  kernelModules = [ "i915" "kvm_intel" ];
+		  systemd.enable = true;
+		  luks = {
+			  devices."root" = {
+				  device = "/dev/disk/by-uuid/75eccc7f-30b0-4fe8-8f82-90edaf284cd5";
+				  allowDiscards = true;
+			  };
+		  };
+	  };

-  boot.initrd.luks = {
-    fido2Support = true;
-    devices."root" = {
-      device = "/dev/disk/by-uuid/75eccc7f-30b0-4fe8-8f82-90edaf284cd5";
-      allowDiscards = true;
-    };
+	  kernelModules = [ "kvm-intel" ];
+	  extraModprobeConfig = ''
+		  options i915 enable_guc=3 enable_fbc=1 fastboot=1
+		  '';
+	  kernelParams = [ "mitigations=off" "luks.options=fido2-device=auto" ];
+	  tmp.useTmpfs = true;
  };

+  zramSwap.enable = true;
+
  services.btrfs.autoScrub = {
    enable = true;
    interval = "monthly";
@@ -16,8 +16,8 @@
 {
  imports =
    [
-      #../../modules/desktop/hyprland/home.nix # Window Manager
-      ../../modules/desktop/sway/home.nix # Window Manager
+      #../../modules/wm/hyprland/home.nix # Window Manager
+      ../../modules/wm/sway/home.nix # Window Manager
      ../../modules/home.nix # Window Manager
    ];

@@ -22,7 +22,7 @@
 {
  imports =                                                         # For now, if applying to other system, swap files
    [(import ./hardware-configuration.nix)] ++                      # Current system hardware config @ /etc/nixos/hardware-configuration.nix
-    (import ../../modules/desktop/virtualisation) ++   # Docker
+    (import ../../modules/wm/virtualisation) ++   # Docker
    (import ../../modules/services/nas) ++                       # Server Services
    (import ../../modules/hardware);                                # Hardware devices

@@ -22,7 +22,7 @@
 {
  imports =                                                         # For now, if applying to other system, swap files
    [(import ./hardware-configuration.nix)] ++                      # Current system hardware config @ /etc/nixos/hardware-configuration.nix
-    (import ../../modules/desktop/virtualisation) ++   # Docker
+    #[(import ../../modules/wm/virtualisation/docker.nix)] ++   # Docker
    (import ../../modules/services/nasbackup) ++                       # Server Services
    (import ../../modules/hardware);                                # Hardware devices

@@ -19,20 +19,22 @@

  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usb_storage" "usbhid" "sd_mod" ];
  boot.initrd.kernelModules = [ "vfio_pci" "vfio" "vfio_iommu_type1" ];
-#  boot.initrd.secrets = {
-#    "/root/NASKeyfile" =
-#        /root/NASKeyfile;
-#  };
-#  boot.initrd.luks.devices = {
-#    NAS-RAID1 = {
-#      device = "/dev/disk/by-uuid/57e6446d-faca-4b67-9063-e8d9afb80088";
-#      keyFile = "/root/NASKeyfile";
-#    };
-#    NAS-RAID2 = {
-#      device = "/dev/disk/by-uuid/b9edc489-ac37-4b28-981d-442722df7ae2";
-#      keyFile = "/root/NASKeyfile";
-#    };
-#  };
+  boot.initrd.secrets = {
+    "/root/NASKeyfile" =
+        /root/NASKeyfile;
+  };
+  boot.initrd.luks.devices = {
+    NAS-RAID1 = {
+      device = "/dev/disk/by-uuid/57e6446d-faca-4b67-9063-e8d9afb80088";
+      keyFile = "/root/NASKeyfile";
+      bypassWorkqueues = true;
+    };
+    NAS-RAID2 = {
+      device = "/dev/disk/by-uuid/b9edc489-ac37-4b28-981d-442722df7ae2";
+      keyFile = "/root/NASKeyfile";
+      bypassWorkqueues = true;
+    };
+  };
  boot.kernelModules = [ "kvm-intel" ];
  boot.extraModulePackages = [ ];
  boot.tmp.useTmpfs = false;
@@ -91,7 +93,7 @@
                
                  volume =  {
                      "ssh://jupiter.home.opel-online.de/mnt/snapshots/Mars" = {
-                          target = "/mnt/nas/Backups/nas/Mars";
+                          target = "/mnt/nas/Backups/Mars";
                          subvolume = {
                              "@nas" = {};
                          };
@@ -99,7 +101,7 @@
                  };
                  volume =  {
                      "ssh://jupiter.home.opel-online.de/mnt/snapshots/Pluto" = {
-                          target = "/mnt/nas/Backups/nas/Pluto";
+                          target = "/mnt/nas/Backups/Pluto";
                          subvolume = {
                              "@/Games" = {};
                              "@/IT" = {};
@@ -184,7 +186,7 @@
 #    };
 #
  fileSystems."/mnt/nas" =
-    { device = "/dev/disk/by-uuid/6f53d32d-b56f-42ec-bfad-c0b8d1114015";
+    { device = "/dev/disk/by-uuid/70523c79-ef5c-40f2-8782-60fc86bb445b";
      fsType = "btrfs";
      options = [ "compress=zstd:9,space_cache=v2,noatime,subvol=@nasbak" ];
    };
@@ -1,111 +0,0 @@
-#
-#  Specific system configuration settings for desktop
-#
-#  flake.nix
-#   ├─ ./hosts
-#   │   └─ ./laptop
-#   │        ├─ default.nix *
-#   │        └─ hardware-configuration.nix       
-#   └─ ./modules
-#       ├─ ./desktop
-#       │   └─ ./hyprland
-#       │       └─ hyprland.nix
-#       ├─ ./modules
-#       │   └─ ./programs
-#       │       └─ waybar.nix
-#       └─ ./hardware
-#           └─ default.nix
-#
-
-{ config, pkgs, user, ... }:
-
-{
-  imports =                                                         # For now, if applying to other system, swap files
-    [(import ./hardware-configuration.nix)] ++                      # Current system hardware config @ /etc/nixos/hardware-configuration.nix
-    [(import ../../modules/desktop/hyprland/default.nix)] ++        # Window Manager
-    [(import ../../modules/desktop/virtualisation/docker.nix)]; # ++   # Docker
-    #(import ../../modules/hardware);                                # Hardware devices
-
-  boot = {                                  # Boot options
-    kernelPackages = pkgs.linuxPackages_latest;
-
-    loader = {                              # EFI Boot
-      systemd-boot.enable = true;
-      efi = {
-        canTouchEfiVariables = true;
-        efiSysMountPoint = "/boot";
-      };
-      timeout = 1;                          # Grub auto select time
-    };
-  };
-
-#  hardware.sane = {                           # Used for scanning with Xsane
-#    enable = false;
-#    extraBackends = [ pkgs.sane-airscan ];
-#  };
-
-#  environment = {
-#    systemPackages = with pkgs; [
-#      simple-scan
-#    ];
-#  };
-
-  programs = {                              # No xbacklight, this is the alterantive
-#    dconf.enable = true;
-#    light.enable = true;
-    ssh.startAgent = false;
-    gnupg.agent = {
-      enable = true;
-      enableSSHSupport = true;
-      pinentryFlavor = "curses";
-    };
-  };
-
-  services = {
-#    tlp.enable = true;                      # TLP and auto-cpufreq for power management
-    #logind.lidSwitch = "ignore";            # Laptop does not go to sleep when lid is closed
-    auto-cpufreq.enable = true;
-    blueman.enable = true;
-    pcscd.enable = true;
-    udev.packages = [ 
-        pkgs.nitrokey-udev-rules
-    ];
-    printing = {                            # Printing and drivers for TS5300
-      enable = true;
-      drivers = [ pkgs.gutenprint ];
-    };
-    avahi = {                               # Needed to find wireless printer
-      enable = true;
-      nssmdns = true;
-      publish = {                           # Needed for detecting the scanner
-        enable = true;
-        addresses = true;
-        userServices = true;
-      };
-    };
-
-    #xserver = {
-    #  libinput = {                          # Trackpad support & gestures
-    #    touchpad = {
-    #      tapping = true;
-    #      scrollMethod = "twofinger";
-    #      naturalScrolling = true;            # The correct way of scrolling
-    #      accelProfile = "adaptive";          # Speed settings
-    #      #accelSpeed = "-0.5";
-    #      disableWhileTyping = true;
-    #    };
-    #  };
-    #  resolutions = [
-    #    { x = 1600; y = 920; }
-    #    { x = 1280; y = 720; }
-    #    { x = 1920; y = 1080; }
-    #  ];
-    #};
-  };
-
-  #temporary bluetooth fix
-#  systemd.tmpfiles.rules = [
-#    "d /var/lib/bluetooth 700 root root - -"
-#  ];
-#  systemd.targets."bluetooth".after = ["systemd-tmpfiles-setup.service"];
-}
@@ -1,82 +0,0 @@
-#
-# Hardware settings for Teclast F5 10" Laptop
-# NixOS @ sda2
-#
-# flake.nix
-#  └─ ./hosts
-#      └─ ./laptop
-#          └─ hardware-configuration.nix *
-#
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
-{
-  imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")
-    ];
-
-  boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" "rtsx_usb_sdmmc" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-intel" ];
-  boot.extraModulePackages = [ ];
-
-  fileSystems."/" =
-    { device = "/dev/disk/by-label/ROOT";
-      fsType = "btrfs";
-      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@" ];
-    };
-
-  fileSystems."/home" =
-    { device = "/dev/disk/by-label/ROOT";
-      fsType = "btrfs";
-      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@home" ];
-    };
-
-  fileSystems."/srv" =
-    { device = "/dev/disk/by-label/ROOT";
-      fsType = "btrfs";
-      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@srv" ];
-    };
-
-  fileSystems."/boot" =
-    { device = "/dev/disk/by-label/BOOT";
-      fsType = "vfat";
-    };
-
-  swapDevices = [ ];
-  
-  networking = {
-    useDHCP = false;                        # Deprecated
-    hostName = "q920";
-    networkmanager.enable = true;
-    interfaces = {
-      enp0s25 = {
-        useDHCP = true;                     # For versatility sake, manually edit IP on nm-applet.
-        #ipv4.addresses = [ {
-        #    address = "192.168.0.51";
-        #    prefixLength = 24;
-        #} ];
-      };
-#      wlo1 = {
-#        useDHCP = true;
-#        #ipv4.addresses = [ {
-#        #  address = "192.168.0.51";
-#        #  prefixLength = 24;
-#        #} ];  
-#      };
-    };
-    #defaultGateway = "192.168.0.1";
-    #nameservers = [ "192.168.0.4" ];
-    #firewall = {
-    #  enable = false;
-    #  #allowedUDPPorts = [ 53 67 ];
-    #  #allowedTCPPorts = [ 53 80 443 9443 ];
-    #};
-  };
-
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-  # high-resolution display
-  hardware.video.hidpi.enable = lib.mkDefault true;
-}
@@ -17,12 +17,12 @@
 #           └─ default.nix
 #

-{ config, pkgs, user, ... }:
+{ config, pkgs, user, agenix, impermanence, ... }:

 {
  imports =                                                         # For now, if applying to other system, swap files
    [(import ./hardware-configuration.nix)] ++                      # Current system hardware config @ /etc/nixos/hardware-configuration.nix
-    [(import ../../modules/desktop/virtualisation/docker.nix)] ++   # Docker
+    [(import ../../modules/wm/virtualisation/docker.nix)] ++   # Docker
    (import ../../modules/services/server) ++                       # Server Services
    (import ../../modules/hardware);                                # Hardware devices

@@ -17,27 +17,31 @@
 #           └─ default.nix
 #

-{ config, pkgs, user, jovian-nixos, ... }:
+{ config, pkgs, user, jovian-nixos, lib, ... }:

 {
  imports =                                                         # For now, if applying to other system, swap files
    [(import ./hardware-configuration.nix)] ++                      # Current system hardware config @ /etc/nixos/hardware-configuration.nix
-    [(import ../../modules/desktop/steam/default.nix)] ++        # Window Manager
-    [(import ../../modules/desktop/kde/default.nix)] ++        # Window Manager
-    [(import ../../modules/desktop/virtualisation/docker.nix)] ++   # Docker
-    (import ../../modules/hardware);                                # Hardware devices
+    [(import ../../modules/wm/steam/default.nix)] ++            # jovian steam
+    [(import ../../modules/wm/kde/default.nix)] ++              # Window Manager
+    (import ../../modules/wm/virtualisation) ++                 # libvirt + Docker
+    [(import ../../modules/wm/virtualisation/kvm-amd.nix)] ++   # kvm module options
+    (import ../../modules/hardware);                                 # Hardware devices

  boot = {                                  # Boot options
-    kernelPackages = pkgs.linuxPackages_latest;
-
    loader = {                              # EFI Boot
-      systemd-boot.enable = true;
+      systemd-boot.enable = lib.mkForce false;
      efi = {
        canTouchEfiVariables = true;
        efiSysMountPoint = "/boot";
      };
      timeout = 1;                          # Grub auto select time
    };
+
+    lanzaboote = {
+        enable = true;
+        pkiBundle = "/etc/secureboot";
+    };
  };

 #  hardware.sane = {                           # Used for scanning with Xsane
@@ -62,19 +66,19 @@
    gnupg.agent = {
      enable = true;
      enableSSHSupport = true;
-      pinentryFlavor = "curses";
+      #pinentryFlavor = "curses";
    };
  };

  services = {
-    blueman.enable = true;
+ #   blueman.enable = true;
    printing = {                            # Printing and drivers for TS5300
      enable = true;
      drivers = [ pkgs.gutenprint ];
    };
    avahi = {                               # Needed to find wireless printer
      enable = true;
-      nssmdns = true;
+      nssmdns4 = true;
      publish = {                           # Needed for detecting the scanner
        enable = true;
        addresses = true;
@@ -84,4 +88,5 @@
    tailscale.enable = true;

  };
+  security.pam.sshAgentAuth.enable = true;
 }
@@ -17,82 +17,71 @@
    [ (modulesPath + "/installer/scan/not-detected.nix")
    ];

-  boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "usb_storage" "usbhid" "sd_mod" "sdhci_pci" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-amd" ];
-  boot.extraModulePackages = [ ];
-  boot.tmp.useTmpfs = false;
-  boot.tmp.cleanOnBoot = true;
+  boot = {
+	  initrd = {
+                  availableKernelModules = [ "nvme" "xhci_pci" "usb_storage" "usbhid" "sd_mod" "sdhci_pci" ];
+		  kernelModules = [ ];
+		  systemd.enable = true;
+		  luks = {
+			  devices."crypted" = {
+				  device = "/dev/disk/by-partlabel/disk-nvme0n1-luks";
+				  allowDiscards = true;
+                  bypassWorkqueues = true;
+			  };
+		  };
+	  };
+
+	  kernelModules = [ "kvm-amd" "amdgpu" ];
+	  kernelParams = [ "luks.options=fido2-device=auto" ];
+	  tmp.useTmpfs = false;
+	  tmp.cleanOnBoot = true;
+  };
+
  zramSwap.enable = true;

-#  services.btrfs.autoScrub = {
-#    enable = true;
-#    interval = "monthly";
-#    fileSystems = [
-#      "/"
-#    ];
-#  };
-#
-#  services.btrbk = {
-#      instances = {
-#          hf = {
-#              onCalendar = "hourly";
-#              settings = {
-#                  incremental = "yes";
-#                  snapshot_create = "ondemand";
-#                  snapshot_dir = "@snapshots";
-#                  timestamp_format = "long";
-#
-#                  snapshot_preserve = "2m 2w 5d 5h";
-#                  snapshot_preserve_min = "latest";
-#                
-#                  volume =  {
-#                      "/mnt/snapshots/root" = {
-#                          snapshot_create = "always";
-#                          subvolume = {
-#                              "@home" = {};
-#                          };
-#                      };
-#                  };
-#              };
-#          };
-#      };
-#  };
+  services = {
+      btrfs.autoScrub = {
+          enable = true;
+          interval = "monthly";
+          fileSystems = [
+              "/"
+          ];
+      };
+      udev.extraRules = ''
+          ACTION=="add", SUBSYSTEM=="block", KERNEL=="mmcblk[0-9]p[0-9]", ENV{ID_FS_USAGE}=="filesystem", RUN{program}+="${pkgs.systemd}/bin/systemd-mount -o noatime,compress-force=zstd:15,ssd_spread,commit=120 --no-block --automount=yes --collect $devnode /run/media/mmcblk0p1"
+          '';
+  };

-#  fileSystems."/" =
-#    { device = "/dev/disk/by-label/NIXROOT";
-#      fsType = "btrfs";
-#      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@,discard=async" ];
-#    };
-#
-#  fileSystems."/home" =
-#    { device = "/dev/disk/by-label/NIXROOT";
-#      fsType = "btrfs";
-#      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@home,discard=async" ];
-#    };
-#
-#  fileSystems."/srv" =
-#    { device = "/dev/disk/by-label/NIXROOT";
-#      fsType = "btrfs";
-#      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@srv,discard=async" ];
-#    };
-#
-#  fileSystems."/nix" =
-#    { device = "/dev/disk/by-label/NIXROOT";
-#      fsType = "btrfs";
-#      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@nix,discard=async" ];
-#    };
-#
-#  fileSystems."/mnt/snapshots/root" =
-#    { device = "/dev/disk/by-label/NIXROOT";
-#      fsType = "btrfs";
-#      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvolid=5,discard=async" ];
-#    };
+  services.btrbk = {
+      instances = {
+          hf = {
+              onCalendar = "hourly";
+              settings = {
+                  incremental = "yes";
+                  snapshot_create = "ondemand";
+                  snapshot_dir = "@snapshots";
+                  timestamp_format = "long";
+
+                  snapshot_preserve = "2m 2w 5d 5h";
+                  snapshot_preserve_min = "latest";
+                
+                  volume =  {
+                      "/mnt/snapshots/root" = {
+                          snapshot_create = "always";
+                          subvolume = {
+                              "@home" = {};
+                          };
+                      };
+                  };
+              };
+          };
+      };
+  };

  fileSystems."/" =
-    { device = "/dev/disk/by-label/NIXROOT";
-      fsType = "ext4";
-      options = [ "defaults,noatime" ];
+    { device = "/dev/mapper/crypted";
+      fsType = "btrfs";
+      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@,discard=async" ];
    };

  fileSystems."/boot" =
@@ -100,12 +89,48 @@
      fsType = "vfat";
    };

-  fileSystems."/sdcard" =
-    { device = "/dev/disk/by-label/sdcard";
-      fsType = "ext4";
-      options = [ "nofail,x-systemd.automount" ];
+  fileSystems."/home" =
+    { device = "/dev/mapper/crypted";
+      fsType = "btrfs";
+      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@home,discard=async" ];
    };

+  fileSystems."/nix" =
+    { device = "/dev/mapper/crypted";
+      fsType = "btrfs";
+      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@nix,discard=async" ];
+    };
+
+  fileSystems."/srv" =
+    { device = "/dev/mapper/crypted";
+      fsType = "btrfs";
+      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@srv,discard=async" ];
+    };
+
+  fileSystems."/swap" =
+    { device = "/dev/mapper/crypted";
+      fsType = "btrfs";
+      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@swap,discard=async" ];
+    };
+
+  fileSystems."/opt" =
+    { device = "/dev/mapper/crypted";
+      fsType = "btrfs";
+      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@opt,discard=async" ];
+    };
+
+  fileSystems."/mnt/snapshots/root" =
+    { device = "/dev/mapper/crypted";
+      fsType = "btrfs";
+      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvolid=5,discard=async" ];
+    };
+
+#  fileSystems."/sdcard" =
+#    { device = "/dev/disk/by-label/sdcard";
+#      fsType = "ext4";
+#      options = [ "nofail,noauto,users,x-systemd.automount" ];
+#    };
+
  fileSystems."/mnt/Pluto" =
    { device = "jupiter:/Pluto";
      fsType = "nfs";
@@ -118,20 +143,19 @@
      options = [ "nofail,noauto,users,x-systemd.automount,x-systemd.device-timeout=10,soft,timeo=14,x-systemd.idle-timeout=1min,sec=sys,exec,nfsvers=4.2" ];
    };

-  swapDevices = [
-    { device = "/dev/disk/by-label/NIXSWAP"; }
-  ];
+
+  swapDevices = [ { device = "/swap/swapfile"; } ];
  

  networking = {
    useDHCP = false;                        # Deprecated
-    hostName = "nix-steamdeck";
+    hostName = "steamdeck";
    wireless.iwd.enable = true;
    networkmanager = {
      enable = true;
      wifi = {
        backend = "iwd";
-        powersave = true;
+        powersave = false;
      };
    };
 #    interfaces = {
@@ -154,4 +178,8 @@
  };

  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+  #powerManagement.powertop.enable = true;
+  powerManagement = {
+    scsiLinkPolicy = "med_power_with_dipm";
+  };
 }
@@ -16,8 +16,8 @@
 {
  imports =
    [
-      ../../modules/desktop/steam/home.nix # Window Manager
-      ../../modules/desktop/kde/home.nix # Window Manager
+      ../../modules/wm/steam/home.nix # Window Manager
+      ../../modules/wm/kde/home.nix # Window Manager
      ../../modules/home.nix # Window Manager
    ];

@@ -32,6 +32,7 @@
      streamlink-twitch-gui-bin
      element-desktop
      pulsemixer
+      #yuzu-early-access
      
      # Display
      light                              # xorg.xbacklight not supported. Other option is just use xrandr.
@@ -0,0 +1,5 @@
+{
+  plugins.bufferline = {
+    enable = true;
+  };
+}
@@ -0,0 +1,16 @@
+{ nvim, ... }:
+{
+  # Import all your configuration modules here
+  programs.nixvim = {
+      enable = true;
+      colorschemes.gruvbox.enable = true;
+
+      imports = [
+        ./bufferline.nix
+        ./plugins.nix
+        ./options.nix
+        ./keymaps.nix
+        ./highlight.nix
+      ];
+  };
+}
@@ -0,0 +1,8 @@
+{
+  highlight = {
+    Comment.fg = "#ff00ff";
+    Comment.bg = "#000000";
+    Comment.underline = true;
+    Comment.bold = true;
+  };
+}
@@ -0,0 +1,8 @@
+{
+  keymaps = [
+    {
+      action = "<cmd>Telescope live_grep<CR>";
+      key = "<leader>g";
+    }
+  ];
+}
@@ -0,0 +1,14 @@
+{
+    config = {
+        globals.mapleader = " ";
+        viAlias = true;
+        vimAlias = true;
+
+        opts = {
+            number = true;         # Show line numbers
+            relativenumber = true; # Show relative line numbers
+
+            shiftwidth = 2;        # Tab width should be 2
+        };
+    };
+}
@@ -0,0 +1,51 @@
+{
+    plugins = {
+        lualine.enable = true;
+
+        cmp = {
+            enable = true;
+            autoEnableSources = true;
+            settings = {
+                sources = [
+                  {name = "nvim_lsp";}
+                  {name = "path";}
+                  {name = "buffer";}
+                  {name = "luasnip";}
+                ];
+
+                mapping = {
+                    "<C-d>" = "cmp.mapping.scroll_docs(-4)";
+                    "<C-f>" = "cmp.mapping.scroll_docs(4)";
+                    "<C-Space>" = "cmp.mapping.complete()";
+                    "<C-e>" = "cmp.mapping.close()";
+                    "<CR>" = "cmp.mapping.confirm({ select = true })";
+                    "<Tab>" = "cmp.mapping(cmp.mapping.select_next_item(), {'i', 's'})";
+                    "<S-Tab>" = "cmp.mapping(cmp.mapping.select_prev_item(), {'i', 's'})";
+                };
+            };
+        };
+
+        lsp = {
+            enable = true;
+
+            servers = {
+                tsserver.enable = true;
+
+                lua-ls = {
+                    enable = true;
+                    settings.telemetry.enable = false;
+                };
+#                rust-analyzer = {
+#                    enable = true;
+#                    installCargo = true;
+#                };
+            };
+        };
+
+        telescope.enable = true;
+
+        treesitter.enable = true;
+
+        luasnip.enable = true;
+    };
+}
@@ -5,6 +5,11 @@
 { pkgs, ... }:

 {
+
+  home = {
+      packages = [ pkgs.gnvim ];
+  };
+
  programs = {
    neovim = {
      enable = true;
@@ -3,7 +3,7 @@

 {
  nix = {
-    distributedBuilds = true;
+    distributedBuilds = false;
    buildMachines = [ {
      hostName = "hades";
      system = "x86_64-linux";
@@ -11,16 +11,16 @@
      sshUser = "nixremote";
      sshKey = config.age.secrets."keys/nixremote".path;
      maxJobs = 1;
-      speedFactor = 8;
+      speedFactor = 4;
      publicHostKey = "c3NoLWVkMjU1MTkgQUFBQUMzTnphQzFsWkRJMU5URTVBQUFBSUVnbld5UVVVYSt2Y0hBS3g2ZWRiVGdxVzhwaCtNQ2lTNmZVd1lqWWNTK28gcm9vdEBoYWRlcwo=%";
      protocol = "ssh-ng";
    } ];
    settings = {
-      trusted-public-keys = [
+      extra-trusted-public-keys = [
        "hades-builder:AFdPgi6Qq/yKqc2V2imgzMikEkVEFCrDaHyAmOJ3MII="
      ];
-      substituters = [
-        "ssh-ng://hades"
+      trusted-users = [
+        "kabbone"
      ];
    };
  };
@@ -24,7 +24,7 @@
    theme = {
      theme = mkOption { type = types.str; default = "catppuccin-mocha"; };
      icon-theme = mkOption { type = types.str; default = "Papirus-Dark"; };
-      font = mkOption { type = types.str; default = "FiraCode Nerd Font 11"; };
+      font = mkOption { type = types.str; default = "Cascadia Code 11"; };
      wallpaper = mkOption { type = types.str; default = ""; };
    };
  };
@@ -16,8 +16,9 @@
      package = pkgs.alacritty;
      settings = {
        font = rec {                          # Font - Laptop has size manually changed at home.nix
-          #normal.family = "Source Code Pro";
-          normal.family = "FiraCode Nerd Font";
+          #normal.family = "FiraCode Nerd Font";
+          normal.family = "Cascadia Code";
+          #normal.family = "Intel One Mono";
          #bold = { style = "Bold"; };
 #         size = 8;
        };
@@ -17,5 +17,5 @@
   #./waybar.nix
   #./games.nix
 ]
-# Waybar.nix is pulled from modules/desktop/..
+# Waybar.nix is pulled from modules/wm/..
 # Games.nix is pulled from desktop/default.nix
@@ -12,6 +12,7 @@

 [
  ./microvm.nix
+  ./hydra.nix
 ]

 # picom, polybar and sxhkd are pulled from desktop module
@@ -5,6 +5,12 @@
      podman ={
        enable = true;
        autoPrune.enable = true;
+        dockerCompat = true;
+      };
+      containers.containersConf.settings = {
+        # podman seems to not work with systemd-resolved
+        containers.dns_servers = [ "192.168.101.1" ];
+        #containers.dns_servers = [ "8.8.8.8" "8.8.4.4" ];
      };
    };

@@ -13,24 +19,42 @@
            enable = true;
            url = "https://git.kabtop.de";
            name = "Homerunner";
-            tokenFile = config.age.secrets."services/gitea/runner-token".path;
+            tokenFile = config.age.secrets."services/gitea/homerunner-token".path;
            labels = [ 
+              "home"
              "debian-latest:docker://node:18-bullseye"
+              "ubuntu-latest:docker://node:16-bullseye"
+              "ubuntu-22.04:docker://node:16-bullseye"
+              "ubuntu-20.04:docker://node:16-bullseye"
+              "ubuntu-18.04:docker://node:16-buster"
              "native:host"
            ];
            hostPackages = with pkgs; [
              bash
-              curl
-              gitMinimal
              coreutils
-              wget
+              curl
+              gawk
+              gitMinimal
              gnused
+              nodejs
+              wget
            ];
+            settings = {
+             # container.options = "-e NIX_BUILD_SHELL=/bin/bash -e PAGER=cat -e PATH=/bin -e SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt --device /dev/kvm -v /nix:/nix -v ${storeDeps}/bin:/bin -v ${storeDeps}/etc/ssl:/etc/ssl --user nixuser --device=/dev/kvm";
+               # the default network that also respects our dns server settings
+              container.network = "host";
+              container.privileged = false;
+             # container.valid_volumes = [
+             #   "/nix"
+             #   "${storeDeps}/bin"
+             #   "${storeDeps}/etc/ssl"
+             # ];
+            };
        };
    };

-  age.secrets."services/gitea/runner-token" = {
-    file = ../../../secrets/services/gitea/runner-token.age;
-    owner = "gitea-runner";
-  };
+    age.secrets."services/gitea/homerunner-token" = {
+      file = ../../../secrets/services/gitea/homerunner-token.age;
+      owner = "gitea-runner";
+    };
 }
@@ -0,0 +1,11 @@
+{ lib, config, pkgs, ... }:
+
+{
+    services.hydra = {
+      enable = true;
+      hydraURL = "http://localhost:3000";
+      notificationSender = "hydra@localhost";
+      useSubstitutes = true;
+    };
+
+}
@@ -1,23 +1,23 @@
-{ microvm, nixpkgs, user, agenix, ... }:
+{ config, microvm, lib, pkgs, user, agenix, impermanence, ... }:
 let
  name = "gitea-runner";
 in
 {
  microvm = {
    autostart = [
-      "gitea-runnervm"
+      name
    ];
    vms = {
      ${name} = {

-
-        pkgs = import nixpkgs {
-          system = "x86_64-linux";
-          config.allowUnfree = true;
-        };
+        inherit pkgs;

        config = {
-          imports = [( ./gitea_runner.nix )];
+          imports = 
+            [ agenix.nixosModules.default ] ++
+            [ impermanence.nixosModules.impermanence ] ++
+            [( ./gitea_runner.nix )];
+
          networking = {
            hostName = "${name}";

@@ -55,6 +55,41 @@ in
            openssh = {
              enable = true;
              settings.PasswordAuthentication = false;
+              hostKeys = [
+              {
+                  path = "/persist/etc/ssh/ssh_host_ed25519_key";
+                  type = "ed25519";
+              }
+              {
+                  path = "/persist/etc/ssh/ssh_host_rsa_key";
+                  type = "rsa";
+                  bits = 4096;
+              }];
+            };
+          };
+
+          fileSystems."/persist".neededForBoot = lib.mkForce true;
+
+          environment = {
+            systemPackages = with pkgs; [           # Default packages install system-wide
+               bash
+               coreutils
+               curl
+               gawk
+               gitMinimal
+               gnused
+               nodejs
+               wget
+            ];
+            persistence."/persist" = {
+              directories = [
+                "/var/log"
+                "/var/lib/private"
+              ];
+
+              files = [
+                "/etc/machine-id"
+              ];
            };
          };

@@ -77,11 +112,18 @@ in
              mountPoint = "/nix/.ro-store";
              tag = "ro-store";
              proto = "virtiofs";
+            }
+            {
+              source = "/etc/vm-persist/${name}";
+              mountPoint = "/persist";
+              tag = "persist";
+              proto = "virtiofs";
            }];
            #writableStoreOverlay = "/nix/.rw-store";
            #storeOnDisk = true;
          };
-        system.stateVersion = "23.05";
+
+          system.stateVersion = "23.05";
        };
      };
    };
@@ -14,7 +14,7 @@
    pkey = "${config.security.acme.certs.${realm}.directory}/key.pem";
    extraConfig = ''
      # for debugging
-      verbose
+      #verbose
      # ban private IP ranges
      no-multicast-peers
      denied-peer-ip=0.0.0.0-0.255.255.255
@@ -13,10 +13,12 @@
 [
  ./postgresql.nix
  ./gitea.nix
+  ./microvm.nix
  ./nextcloud.nix
  ./matrix.nix
  ./coturn.nix
  ./jitsi.nix
+  ./ollama.nix
 ]

 # picom, polybar and sxhkd are pulled from desktop module
@@ -1,5 +1,4 @@
 [Definition]
 failregex =  .*(Failed authentication attempt|invalid credentials|Attempted access of unknown user).* from <HOST>
 ignoreregex =
-#journalmatch = _SYSTEMD_UNIT=gitea.servie
-journalmatch = 
+journalmatch = _SYSTEMD_UNIT=gitea.service + _COMM=gitea
@@ -0,0 +1,4 @@
+[Definition]
+failregex =  <HOST> - .*(401 Unauthorized|invalid credentials|Attempted access of unknown user).*
+ignoreregex =
+journalmatch = _SYSTEMD_UNIT=podman-open-webui.service + _COMM=podman-open-webui
@@ -7,7 +7,7 @@
 {
  services.gitea = {
    enable = true;
-    dump.enable = true;
+    dump.enable = false;
    lfs.enable = true;
    dump.type = "tar.xz";
    database.type = "postgres";
@@ -1,31 +1,59 @@
 { lib, config, pkgs, ... }:

-let
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";                  # Nix Packages
-in
 {
-    imports = [ <nixpkgs/nixos/modules/virtualisation/qemu-vm.nix> ];
    virtualisation = {
      podman ={
        enable = true;
        autoPrune.enable = true;
+        dockerCompat = true;
+      };
+      containers.containersConf.settings = {
+        # podman seems to not work with systemd-resolved
+        containers.dns_servers = [ "8.8.8.8" "8.8.4.4" ];
      };
-      memorySize = 4096;
-      diskSize = 10240;
    };

    services.gitea-actions-runner.instances = {
-        nixrunner-test = {
+        serverrunner = {
            enable = true;
            url = "https://git.kabtop.de";
-            name = "nix_runner_test";
-            #tokenFile = "./gitea_token";
-            token = "vlUBkX5IbJKTBO3HAGqFM1fEOw2UqXpX87LcdJRY";
+            name = "Server runner";
+            tokenFile = config.age.secrets."services/gitea/serverrunner-token".path;
            labels = [ 
+              "server"
              "debian-latest:docker://node:18-bullseye"
+              "ubuntu-latest:docker://node:16-bullseye"
+              "ubuntu-22.04:docker://node:16-bullseye"
+              "ubuntu-20.04:docker://node:16-bullseye"
+              "ubuntu-18.04:docker://node:16-buster"
+              "native:host"
            ];
+            hostPackages = with pkgs; [
+              bash
+              coreutils
+              curl
+              gawk
+              gitMinimal
+              gnused
+              nodejs
+              wget
+            ];
+            settings = {
+             # container.options = "-e NIX_BUILD_SHELL=/bin/bash -e PAGER=cat -e PATH=/bin -e SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt --device /dev/kvm -v /nix:/nix -v ${storeDeps}/bin:/bin -v ${storeDeps}/etc/ssl:/etc/ssl --user nixuser --device=/dev/kvm";
+               # the default network that also respects our dns server settings
+              container.network = "host";
+              container.privileged = false;
+             # container.valid_volumes = [
+             #   "/nix"
+             #   "${storeDeps}/bin"
+             #   "${storeDeps}/etc/ssl"
+             # ];
+            };
        };
    };
-    users.users.root.initialPassword = "babablup";
-    system.stateVersion = "23.11";
+
+    age.secrets."services/gitea/serverrunner-token" = {
+      file = ../../../secrets/services/gitea/serverrunner-token.age;
+      owner = "gitea-runner";
+    };
 }
@@ -0,0 +1,129 @@
+{ config, microvm, lib, pkgs, user, agenix, impermanence, ... }:
+let
+  name = "gitea-runner";
+in
+{
+  microvm = {
+    autostart = [
+      name
+    ];
+    vms = {
+      ${name} = {
+
+        inherit pkgs;
+
+        config = {
+          imports = 
+            [ agenix.nixosModules.default ] ++
+            [ impermanence.nixosModules.impermanence ] ++
+            [( ./gitea_runner.nix )];
+
+          networking = {
+            hostName = "${name}";
+
+            firewall = {
+              enable = true;
+                allowedUDPPorts = [  ];
+                allowedTCPPorts = [  ];
+            };
+          };
+          systemd.network = {
+              enable = true;
+              networks = {
+                  "10-lan" = {
+                      matchConfig.Name = "*";
+                      networkConfig = {
+                        DHCP = "yes";
+                        IPv6AcceptRA = true;
+                      };
+                  };
+              };
+          };
+
+          users.users.${user} = {                   # System User
+            isNormalUser = true;
+            extraGroups = [ "wheel" ];
+            uid = 2000;
+            openssh.authorizedKeys.keys = [
+              "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIANmaraVJ/o20c4dqVnGLp/wGck9QNHFPvO9jcEbKS29AAAABHNzaDo= kabbone@kabc"
+              "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIIgo4IP8ISUohyAMiDc3zEe6ESUE3un7eN5FhVtxZHmcAAAABHNzaDo= kabbone@kabc"
+              "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIKVDApb3vZ+i97V4xLJh8rUF6z5OVYfORlXYbLhdQO15AAAABHNzaDo= kabbone@hades.home.opel-online.de"
+              "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIB0q++epdX7feQxvmC2m/CJEoJbkqtAJy6Ml6WKHxryZAAAABHNzaDo= kabbone@hades.home.opel-online.de"
+            ];
+          };
+          services = {
+            openssh = {
+              enable = true;
+              settings.PasswordAuthentication = false;
+              hostKeys = [
+              {
+                  path = "/persist/etc/ssh/ssh_host_ed25519_key";
+                  type = "ed25519";
+              }
+              {
+                  path = "/persist/etc/ssh/ssh_host_rsa_key";
+                  type = "rsa";
+                  bits = 4096;
+              }];
+            };
+          };
+
+          fileSystems."/persist".neededForBoot = lib.mkForce true;
+
+          environment = {
+            systemPackages = with pkgs; [           # Default packages install system-wide
+               bash
+               coreutils
+               curl
+               gawk
+               gitMinimal
+               gnused
+               nodejs
+               wget
+            ];
+            persistence."/persist" = {
+              directories = [
+                "/var/log"
+                "/var/lib/private"
+              ];
+
+              files = [
+                "/etc/machine-id"
+              ];
+            };
+          };
+
+          microvm = {
+            hypervisor = "qemu";
+            vcpu = 4;
+            mem = 4096;
+            balloonMem = 4096;
+            #kernel = pkgs.linuxKernel.packages.linux_latest;
+            interfaces = [
+            {
+              type = "user";
+              id = "vm-${name}";
+              mac = "04:00:00:00:00:01";
+            } ];
+             shares = [{
+              source = "/nix/store";
+              mountPoint = "/nix/.ro-store";
+              tag = "ro-store";
+              proto = "virtiofs";
+            }
+            {
+              source = "/etc/vm-persist/${name}";
+              mountPoint = "/persist";
+              tag = "persist";
+              proto = "virtiofs";
+            }];
+            #writableStoreOverlay = "/nix/.rw-store";
+            #storeOnDisk = true;
+          };
+
+          system.stateVersion = "23.05";
+        };
+      };
+    };
+  };
+}
@@ -43,10 +43,23 @@
    #autoUpdateApps.enable = true;
    };

-    services.redis.servers.nextcloud = {
+    services.onlyoffice = {
        enable = true;
-        user = "nextcloud";
-        port = 0;
+        hostname = "docs.cloud.kabtop.de";
+        postgresName = "onlyoffice";
+        postgresHost = "localhost";
+        postgresUser = "onlyoffice";
+        postgresPasswordFile = config.age.secrets."services/nextcloud/onlyofficedb".path;
+        jwtSecretFile = config.age.secrets."services/nextcloud/onlyofficejwt".path;
+    };
+
+    services.redis = {
+        vmOverCommit = true;
+        servers.nextcloud = {
+            enable = true;
+            user = "nextcloud";
+            port = 0;
+        };
    };

    services.nginx = {
@@ -56,6 +69,9 @@
          enableACME = true;
          forceSSL = true;
        };
+        "${config.services.onlyoffice.hostname}".listen = [ {
+            addr = "127.0.0.1"; port = 8080;
+        } ];
      };
    };

@@ -67,9 +83,22 @@
        file = ../../../secrets/services/nextcloud/adminpassFile.age;
        owner = "nextcloud";
    };
+    age.secrets."services/nextcloud/onlyofficedb" = {
+        file = ../../../secrets/services/nextcloud/onlyofficedb.age;
+        owner = "onlyoffice";
+    };
+    age.secrets."services/nextcloud/onlyofficejwt" = {
+        file = ../../../secrets/services/nextcloud/onlyofficejwt.age;
+        owner = "onlyoffice";
+    };

    systemd.services."nextcloud-setup" = {
        requires = ["postgresql.service"];
        after = ["postgresql.service"];
    };
+
+    security.acme.defaults.email = "webmaster@kabtop.de";
+    security.acme.defaults.webroot = "/var/lib/acme/acme-challenge";
+    security.acme.acceptTerms = true;
+
 }
@@ -0,0 +1,28 @@
+
+{ config, pkgs, ... }:
+let
+  ollamahostname = "llm.kabtop.de";
+in
+{
+  virtualisation.oci-containers.containers."open-webui" = {
+    autoStart = true;
+    image = "ghcr.io/open-webui/open-webui:ollama";
+    volumes = [
+      "/var/lib/open-webui:/app/backend/data"
+    ];
+    hostname = "open-webui";
+    ports = [ "8081:8080" ];
+  };
+
+  services = {
+    nginx = {
+      virtualHosts = {
+          ${ollamahostname} = {
+              enableACME = true;
+              forceSSL = true;
+              locations."/".proxyPass = "http://localhost:8081";
+          };
+      };
+    };
+  };
+}
@@ -7,28 +7,28 @@
 {
  services.postgresql = {
    enable = true;
-    package = pkgs.postgresql_14;
+    package = pkgs.postgresql_15;
    settings = {
        max_connections = 200;
        listen_addresses = "localhost";
        password_encryption = "scram-sha-256";
-        shared_buffers = "512MB";
-        work_mem = "8MB";
+        shared_buffers = "4GB";
+        work_mem = "2GB";
+        maintenance_work_mem = "500MB";
        autovacuum_work_mem = -1;
-        min_wal_size = "1GB";
-        max_wal_size = "4GB";
        log_timezone = "Europe/Berlin";
        timezone = "Europe/Berlin";
    };
    authentication = pkgs.lib.mkOverride 14 ''
        local  all         postgres        peer
        host   giteadb     gitea          localhost scram-sha-256
-        host  woodpeckerdb woodpecker     localhost scram-sha-256
        host   nextclouddb nextcloud      localhost scram-sha-256
        host   synapsedb   synapse        localhost scram-sha-256
        host   whatsappdb  mautrixwa      localhost scram-sha-256
        host   telegramdb  mautrixtele    localhost scram-sha-256
        host   signaldb    mautrixsignal  localhost scram-sha-256
+        host   onlyoffice  onlyoffice     localhost scram-sha-256
+        local  onlyoffice  onlyoffice      peer
    '';
    initialScript = config.age.secrets."services/postgresql/initScript.sql".path;
  };
@@ -0,0 +1,16 @@
+{ pkgs, lib, config, ... }:
+
+{
+    options = {
+        desktop = {
+            wm = lib.mkOption { type = types.str; default = "sway"; };
+            taskbar = lib.mkOption { type = types.str; default = "waybar"; };
+            launcher = lib.mkOption { type = types.str; default = "bemenu"; };
+        };
+    };
+
+    config = {
+        imports =
+          (import ./ + (desktop.wm)) ++
+    };
+}
@@ -11,10 +11,10 @@
 #               └─ hyprland.nix *
 #

-{ config, lib, user, pkgs, ... }:
+{ config, lib, user, pkgs, desktop, ... }:

 {
-  imports = [ ../../programs/waybar.nix ];
+  imports = [ ../waybar.nix ];

  hardware.opengl = {
    enable = true;
@@ -40,6 +40,7 @@
      rocmPackages.clr.icd
      rocmPackages.clr
      clinfo
+      waybar
    ];
  };

@@ -73,7 +73,7 @@
        terminal = "${pkgs.alacritty}/bin/alacritty";
    
        fonts = {
-            names = [ "Source Code Pro" ];
+            names = [ "Cascadia Code" ];
            size = 10.0;
        };
        
@@ -212,6 +212,9 @@
            "${mod}+Shift+9" = "move container to workspace number 9";
            "${mod}+Shift+0" = "move container to workspace number 10";
  
+            "${mod}+Tab" = "workspace next";
+            "${mod}+Alt+Tab" = "workspace prev";
+
            "${mod}+k" = "splith";
            "${mod}+v" = "splitv";
  
@@ -258,11 +261,14 @@
    '';
  };

-  programs.swaylock.settings = {
-    color = "000000";
-    image = "$HOME/.config/lockwall"; 
-    indicator-caps-lock = true;
-    show-keyboard-layout = true;
+  programs.swaylock = {
+      enable = true;
+      settings = {
+          color = "000000";
+          image = "$HOME/.config/lockwall"; 
+          indicator-caps-lock = true;
+          show-keyboard-layout = true;
+      };
  };

  services.swayidle = {
@@ -13,5 +13,5 @@

 [
  ./docker.nix
-#  ./qemu.nix
+  ./qemu.nix
 ]
@@ -6,7 +6,11 @@

 {
  virtualisation = {
-    docker.enable = true;
+    podman = {
+        enable = true;
+        autoPrune.enable = true;
+        dockerCompat = true;
+    };
  };

  users.groups.docker.members = [ "${user}" ];
@@ -17,9 +21,9 @@
  #  '';                                                           # Alias to easily start container
  #};

-  environment.systemPackages = with pkgs; [
-    docker-compose
-  ];
+#  environment.systemPackages = with pkgs; [
+#    docker-compose
+#  ];
 }

 # USAGE:
@@ -0,0 +1,12 @@
+#
+# KVM module options amd
+#
+
+{ config, pkgs, user, ... }:
+
+{                                             # Add libvirtd and kvm to userGroups
+  boot.extraModprobeConfig = ''
+    options kvm_amd nested=0 avic=1 npt=1
+  '';                                         # Needed to run OSX-KVM 
+}
+
@@ -0,0 +1,13 @@
+#
+# KVM module options intel 
+#
+
+{ config, pkgs, user, ... }:
+
+{                                             # Add libvirtd and kvm to userGroups
+  boot.extraModprobeConfig = ''
+    options kvm_intel nested=1
+    options kvm_intel emulate_invalid_guest_state=0
+    options kvm ignore_nsrs=1
+  '';                                         # Needed to run OSX-KVM 
+}
@@ -5,12 +5,6 @@
 { config, pkgs, user, ... }:

 {                                             # Add libvirtd and kvm to userGroups
-  boot.extraModprobeConfig = ''
-    options kvm_intel nested=1
-    options kvm_intel emulate_invalid_guest_state=0
-    options kvm ignore_nsrs=1
-  '';                                         # Needed to run OSX-KVM 
-
  users.groups.libvirtd.members = [ "root" "${user}" ];

  virtualisation = {
@@ -9,14 +9,6 @@
    waybar
  ];

-#  nixpkgs.overlays = [                                      # Waybar needs to be compiled with the experimental flag for wlr/workspaces to work
-#    (self: super: {
-#      waybar = super.waybar.overrideAttrs (oldAttrs: {
-#        mesonFlags = oldAttrs.mesonFlags ++ [ "-Dexperimental=true" ];
-#      });
-#    })
-#  ];
-
  home-manager.users.${user} = {                           # Home-manager waybar config
    programs.waybar = {
      enable = true;
@@ -19,29 +19,42 @@ let
  ];

  server = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDwN8p78OncPIRUfV64PLHOem4LtlQ3opOJwLEYqdGVx";
+  server2 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPm3epi3v+yuskxQZgmPdkVDET8IGeYA6LbTCqPWqkz+";
  dmz = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAmivVLbkJJ1anwQ8CeNT7rv0Qxinp1LIQIjVWZpnIE5";
  hades = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEgnWyQUUa+vcHAKx6edbTgqW8ph+MCiS6fUwYjYcS+o";
  nasbak = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOdoxslkKn3ouadPOHmDN7e5AtoJmnllnUmhl1j9qfzz";
  jupiter = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDBQr9/TIeAd25h0gfOPjoHs6JMeye4V04LuFufbe1S/";
-  steamdeck = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGV8tMIza5FOB3DQhiYaS3QG67n4J0e4okCrvoxPxneA";
+  steamdeck = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINcbvtlL9xFq6kcvE6x20/Es5PVWMhbBvra8HjGUm4NB";
+  laptop = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICLDA3tmyCR4ogX7mgwaEhsceqALQvq9IqXhg8rF0OIi";
+  homerunner = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP5MASizLhydfxn0AWcG6LfeC4fghLTDVsLbEHDnIAhc";
+  serverrunner="ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHfLhlJX2VlZE4myreojQ0hqCSL28kE9Y3F65uumgrSK";
  systems = [ 
      server
+      server2
      dmz
      hades
      nasbak
      jupiter
      steamdeck
+      laptop
+      homerunner
+      serverrunner
  ];
  servers = [
      server
+      server2
  ];
-  dmzs = [
-    dmz
+  homerunners = [
+    homerunner
+  ];
+  serverrunners = [
+    serverrunner
  ];
  buildClients = [
      nasbak
      jupiter
      steamdeck
+      laptop
  ];
  buildServer = [
      hades
@@ -59,9 +72,12 @@ in
        "services/matrix/signal-registration.age".publicKeys = servers ++ users;
        "services/nextcloud/adminpassFile.age".publicKeys = servers ++ users;
        "services/nextcloud/dbpassFile.age".publicKeys = servers ++ users;
+        "services/nextcloud/onlyofficedb.age".publicKeys = servers ++ users;
+        "services/nextcloud/onlyofficejwt.age".publicKeys = servers ++ users;
        "services/gitea/databasePassword.age".publicKeys = servers ++ users;
        "services/gitea/mailerPassword.age".publicKeys = servers ++ users;
-        "services/gitea/runner-token.age".publicKeys = dmzs ++ users;
+        "services/gitea/homerunner-token.age".publicKeys = homerunners ++ users;
+        "services/gitea/serverrunner-token.age".publicKeys = serverrunners ++ users;
        "keys/nixremote.age".publicKeys = buildClients ++ users;
        "keys/nixservepriv.age".publicKeys = buildServer ++ users;
    }
@@ -1,26 +1,23 @@
 age-encryption.org/v1
-> ssh-ed25519 neExcQ 5fd3qL7THeLFI9aDjn4hWHd3u8mjS8Sj/BZRcaDmen4
-lbXCh+bs0fPAoZFjjHgVrZ1CLAA7YZZgdDdg93TgRMU
+-> ssh-ed25519 neExcQ FMwvw6TmjR3KbTH9UgtlHGmC3ZM9s1+g2Lb2B4oSJWI
+l9TBPRZpSM1Wky9J+uNaKSYVI65MlLxTU7Kh2uC9Ijs
+-> ssh-ed25519 WiIaQQ J3tqbCwliMu7Hp/diV45LB0z2EWpLAwivGxxNQm1O28
+O7EDQl7x7htiIyVOQfSWHQbIxVWEnDJ/rOwE7Jey6go
 -> ssh-rsa VtjGpQ
-L3llq7FJa46xk9332WXFxuwDeHJ8NT5b5/NK9qwFzlOXhuhP7De87QWohdhqy+OG
-30yUkogQB/atK2EqcDDovV/7VhptOCi/oRTbF/PqkZIvnCK7n8wWD4jeqfIb7OGT
-gElsnZavoPunN6XEeIqdwLDe5RjTO6Rtibqoq5s5IiHs1sOJgvCeVl8vub+OQnC1
-0QUUfkup6xMyvOzYdo73vUjuB/c7MekBjAW3KEkzmuub2Xo5y4TWptBda51hxQUV
-C7W7uv0nnzRHZhZi0JkebW/cg097m9EF9rcSpjWwWD34AwICPOXq2Zx8eTZHWkMQ
-3Ayp1QEDs1JJbUubNXCVkIAB/UJ1OP69txvyyaAKvdmdgc8Voqu+4EZtvuDAYIgY
-7ZVZgxGDn7AO+bJ80c90akO4l6OGceZPIeZYdqm90JzPP7jqIs12up2/mR8AjSV3
-Hxb35hsrbyNq1Sy9llOkQXbdQNF9FR17LdL5srkitEKW8Y6vSvxd8m8GvhBUbupC
-DPu/59qnt6WNzsrDFhDxDHufgVY041ypTMjnhh15810Njoyo0MJaDA9yQp3MBhRP
-H5en9w+Z6u0UnJxoEasJfBGXoo3r/WYgw8n55D/OWyUs4PsfIp1rxbY3ju+RlO64
-uWBXkjb7Ti/tFdYxlfMGFV0hXVjOltkCcuvOw/9q8+A
-> piv-p256 grR75w AkG/0MWcPDUgXhADzy3xYF+Am85Bi+mnfSQGqTm8mF7a
-00jDFBDhiYD6RDXFfWBl67HRAOtGt0wRGmzmKGovLTw
-> piv-p256 RQguQQ A2dzhuogDhn6aphyEUcJY9kNcgdJgsVc2crgwZa/n2iw
-VCV4Hsp8+4NuRovNkwpyc1FYZTqfLe9+Ez0l2iQHmaw
-> w1Z-grease ]1R^*NV( 0j[&gA>h G?V($c
-L9YIphVL4BPR2FV77nylOZ1sKM1R/xKuSxUljov1DpXPxaMwhSkTXp9YamxdRDim
-1J9IHXNcVcJWukQL
--- hCGVjhVoRxzGtj/wV1wFd57NqM8vWmoh3+GqcNKZExM
-í'Ì-�aêºöÄÃ«dý
-nNÇñbÞj³?‹€ÂÐOG¿Ûäò
-ÌŒ#\|~žâ"áÔì½T¸É�
+BE/OvVUprp821b/gLSDol0R0P65wwtYHKulHt2Y1Ik02w/A/GCJbVX1hAbxkhRnR
+5em/iKrbG5J3kabFgV/2VLB21yzcrdip0Cvzbgn0HsZ7I0PS80W+Nz054cdH6QV/
+A+iveZxwS0x5VWI1//mmPp6YGeEOw89r/KyIZ7As8gTmVzQoVEeaqUsP9A2/+VuG
+J6gbE6vCb5jxJ7OrLZbtBjfJhac3g7KHfy9QcLNRDSR+r0YVYOElUSyYdz3DUbJp
+vCkNdm2s00wzAobyK5KLx4k9UB+1kJRPjP52Uxt4A+pEjIviH1vTnHzQb+vL4LuR
+qR6spF4vXHj14eGva51+8bxuUBj3kx9zS4XFTLug9B9xe8XgiPJDq109/fzCLkyr
+CZwmvAIUbghLzVw5ub4It+79GKxYXH9GjkWmVQX1J1a6ls7Fvy8pW90Fh2N5M+wk
+FTQru+OuwfllWUZaUWpE1mUzu65CZ84Kfg5slm3oY/y8E6UEmHiwdpCD1Y7mxGwl
+hlQAhOzXyiNDHtWdvRaA66if7+heTvkEoKD5/owUJ0tJTMyvZgah0r2OGbKWluTv
+w6DMlKQFtnnW437t3QZFEWmz6r8UV53CzVIjcOv6Nd8za20RKofmOCeyVJ5GRNk
+weL94rH3Mv5YKh3/mJGj4fsYgka3uRO+rV6G7fNZcfQ
+-> piv-p256 grR75w AnCspIRjswTZ8aEXA15AQiJDKmUiHQhvKg4Rhfre3kCu
+Prp1jHRXIdTXapLZgjWwjy091uc37kCIvGstSOxmNbI
+-> piv-p256 RQguQQ AxfKlFTYgyFzB7sxct0s3/QcoVs1AFwSysZTTBhJjwZz
+GYuHnz8yk5TsY/y2oibHnkFh+Ah956ZiSKXzbT5Fu+A
+--- ++NTK2N0Od5wJsDHGXUg5AbVPNRl2siwehTeRHNMkec
+T„ÇrI�Ø“b4 €tº!5d©C‘«/w[mA/ýÕÇ\] £N‹!„~å²†Ž¢¯‚ÀrÆÖiéßm`ùÒYéÚ
@@ -0,0 +1,23 @@
+age-encryption.org/v1
+-> ssh-ed25519 1fxDZw HPqtOnCf0xv43GQmB6iSSLGK6r/5pCFFZJC37ioMIw0
+VjvteDjUqqkBas9FzZKxlA1y5/TwIB44I7yNH3KBDYA
+-> ssh-rsa VtjGpQ
+Xx8tuS0ClpvIEn/diIhCInLuiNym22i0SQZCkFCz5V0FKNM0L9hzlqU2A2wLemgz
+iy1So0jNJWGt9ylUCyPI9ucyLUgoXFXiQjaMkI85yj+xuUDHkmereRMW3AQD+2LL
+NHsmQQchtmQg/gCZY0MS7gq++ULDwlakAkwMP0U6T19i299eBSBL4Zoj00rKNlx
+KLe0jbNlIe1uhVLYRfyz3S0I9z8gWDSQ8soFoqrJwKVHsO7wmH/3a0dCEWSHRRVm
+MRfU/Oy7A8U+iD37z9DxSN2O6hKRLMDu/NyTXUV95ImYwOcA7ya4nShwpB7vZLop
+Vu/BtX5HZ7JvBK3kApyR+Da5LYsBhqrDmqXqtykjn8TM0WG65jLKp5XolEcGEfUe
+KrqVMhVm+d2AijpRvsbOv13B7UmZkxBP9+6/o7uujv9nV5uSoGwv9tZn9ubeZyXo
+U7q3MaURqbgv6YV+h/aJ1X0URmPMyjUgkCLI3HbKJV+ZQH1jbNsn0aiVU0d0MXBb
+cE1NIZdfrQ/+Mp14KuiKoY/ycrJPQkg+Au8LANSk/pzH/lvGO1EP50eBRz4hIqEg
+RaNII+fQosyr10HPvlgMfEZQnDoG6H+Tvhgt4S6Ex9lyjKASnx/SQyRwhd9SPgDb
+bArbSq4lJ59rqw7TX2IrkjDgvv/FMqdcxjW+kIOTWDQ
+-> piv-p256 grR75w A1d8pk5Qfx1xq9vApCkKKj6gx1elqSYxLezwoChk3k7Z
+AeYO+rslswXdRJK/pwe9m3CNHIKsrRkt1lamyysDNQk
+-> piv-p256 RQguQQ AukcSmMTNQQZdr5zDOjMTnsOFZp5H5D5ohuVdIQUpUYM
+aJqrWcaXdpfS2vakEu5vi/AMHnoUUrUpm0bRRcCxiE8
+--- fNTWHdKIXpbJsZo2WnMAPXTNMtr0hKkgivCIi1qiQps
+XƒŽR0jÙebMB7v6“‚È¦~
+ëª€“8<=
+2iŸ¾Š2ìJð]L×íp
@@ -1,23 +1,23 @@
 age-encryption.org/v1
-> ssh-ed25519 neExcQ vhw6kpdlJFJo6gnr0ZPvI9Gh8sKnPieuz39RruqunWg
-08MQyawHgAvXst11hitF0MGeZhGu0Mc3h9qZOod3ies
+-> ssh-ed25519 neExcQ Qx3NuIC3HnyhLAPB6NGLlO8073iIEXQ3VpVDvsPsLVk
+9Cz7AXaP/EorKrdLxMfaWJJsCIv5u6upJIaNbLiDleA
+-> ssh-ed25519 WiIaQQ AS+i8m6vO83lj5vZ1lr+FiM1SO1v7BU6OWertpdTXSU
+LIitIW7F/8idoKvgHmirFp1V9RlObyqOueDVIdBdRM0
 -> ssh-rsa VtjGpQ
-D7ev60dMR0qFEN2hywO/ltgi5UzDf8uF9/i64I06Q4h6284drcLEuGTNrBCmaEYt
-nIiz06izaS9RAjjE3NVI6FHOrjNAodurahseSjj0GuN0pbq5utxrAUBLQOwAIWQ6
-ZZOT4Lem3N36f6V7V3tRrzp3xx0w9uQOdC7ksrzCu04+MSL8QPKobymPFJAlIoLd
-HSUgAI46Y3JV4IgDFuRosyl1m0UkFUBGhJn3BWl/3xAjuRnguWAVLig1obbvRmnB
-xwGju2QlDf4NofiD0Gfmx/5k/r0au+5O1PMBgxRznr9BxVrZg2VHsjd6hBtoV4VT
-r+jpfW8ooB3uvkXiCOlmLEjAJHhSA0Y/UOzZ8arpq7ays3EfwoBEX6pC6EDc7seS
-DXXovs/iV6hvrrMKyiLkQrzMYU9KLmPwxzCUi8iw63pZ3ZZJUdlYHlPObY8/Bo24
-S/bPCQiW8bBSro4H/gtLNSF9Akxi/RoWcKFeUmiggVvmBRW7m7NqcFMxpy0PRAeW
-iAzsi4FY7LxEpl5e8UgAHpJ4+I8yK0UVuTaL5K+qUQqfH68J2VSVUU2WFtEiJlqk
-FOzMspFUuxVdPHWPqnlz5ae3G31tt4edwuvCf/47l4HaY5ISYyxTLTL0ceaayyh+
-zyFIpuJGZk3WGyVcVnbJmbSD49y9sBPcv9HFsl2KU8k
-> piv-p256 grR75w AlZtjU5uFGKQhLJ8CwdlvZHL6uzgRRWs86xnKQHwavPO
-BktKjijc+nmK+Mh63YXQAISc0QvAw5D9hxHEx5aSudg
-> piv-p256 RQguQQ AqJIDOrRVsshdjIXGL++7ayldhKhQrAeD/4fYCphz7ir
-fpqG3T1UK7ITzEJM0obllPRRC0rayjyf/PH2GFkvALI
-> Y~&-grease vN; 3+DZgw4{
-FkvohbSMmTk0pxttKEzRiIt2RIbeC3+5Dsnr585YRCIXIT4
--- KrOD9AxqOizLdfkOpEmqFwFtAJWi7DSjnZguQcBG1p0
-ÚŽ¨ÃõÜ îmEò=Ïk�ž5ZâòDl†Í&E!•Î¢T‘k_#“Š:‰¤‚t¤¯9ñ*zî?�¬ ¦:HÕ
+FdINMHPfPVgkQk0A5g6uDRQmZxI0h74QkJSdYUtHRfbqBP0R3f4TrqbtO4n6E7pR
+5NYLkqyZND7ApC10hoQ2UJF22Ja06ZvWhhM7Zsl0X3u/58NhgXsXWy92I2sniBa4
+DF6T3AD4bQOF4Px2A/+lnA++NIWHdroqghojWOAZazvLFaFa6HtIdrTiMb2bojuU
+qxepekbRwJBEm9/5bKHZlEmwx3rJsYxrNKEkxPrBvNdPbnwgxrvhOXxeQJghyGGw
+vnCRHKDbqvRIWfkmftRjNQMHUSMitDJHUOPsG9z5KBr4M7n7B1bV5ozsLsVyUUmE
+6vBvrOPz9+RiE9H61PlAvPFMmKBTQgRf8+mjbU0RGxScqLcUoHCud2x3O+WqlLoP
+TMQtye8ayRPgG3PbwP4pO3olcA9ANEdd2Jfo+HG4izbJxdCTbOMfEFTJIEfyGMIo
+lo0Hh0EIijFAVfyAH6G/Rv1KggpINr8fTxbWz8i1PXTqzBsjfrqbHWWRrE/VJSYI
+x9bjSHeWCOs+IlZ2YEB8dshJe5smrTnKpFYrj3kvLHOiC1jKUJdDZooQex4nkXpW
+mMKIOb/VF6/QM3NkmJKLdnMJenIKL1Vqbrv/Lqu1/FaINqRsIGTXCsQs+JjxrcfX
+zxpzs7Bk2eV/BaiJxJ7Cjfx1gO37GpL0kzCMuN1xnWs
+-> piv-p256 grR75w Azu36XfRZ2Evj79zCs8RA5lwbMe2Je0oBI5JM+3MC/cO
+p8nO/p2M3pvEevZLLItNDSz64Ju8yBA2GPBnTWMN25I
+-> piv-p256 RQguQQ Av9ILPK7bsPNqgudLMq88MNSWrB+xrBVfxX3bjVCquvj
+0iwRR9htchLUk88RRooXsP0H39FfybCPMQC8AMxgu/0
+--- puq9s7iYi1A0v+7Qhsqo05Yfxtg5kHJK66RM1TDLtNM
+‡![˘Ąëu_Ď(*0źĹ´8«°ęŠű"úÄFsnď"TęĽ-„�˝ş˙žÇwťw'Îü˘4ľ„«sd_!
@@ -1,24 +1,21 @@
 age-encryption.org/v1
-> ssh-ed25519 jFEPfw XXaqTOr4LBcwpiKwlBq0FxQNTgJ7qkqpw6VIFkTF3lk
-lx+uvRJlBV9cYCvgeIz6wQOGJRl+KVYOniPq0Ha0A+s
+-> ssh-ed25519 1fxDZw TDpxzsr/x1p3WR7SKVetYVlKqdIxMI6w98tM5MIHC30
+HmWHgsw11pqILyvSl0FjeOokMuxlA9u128aAECK0Qvc
 -> ssh-rsa VtjGpQ
-QFCykX5qOiX/CHsLDcUF2GwABO54bc4n61wJOIaVRpK4Axbhu2uLx57mpiwiQ2ue
-6Rlj0ZHL7XZgduvg4Q7MCkHcyx92abLs5BrDJOkiiL7NZcBlV5NfdJ8aPx2B9Fo8
-ng3NK3xe3eVycd6cKHl6MjLfYOP2XCYFHolPJ0BXfUtajkFfOmKUP8ZYdmCkaqPy
-1owFQasKk6TnrBFFq4DsdXwhGccjd6vJE5sLr0G36qbWNNQWtIWqcD/w7NzbHTQ+
-Ynn5GDZHbKR/M1TSGQ5ZQQw3GLM6gnzheMXWf7cMYJGIUU22vUfn4m7U3ZMTTqeJ
-vkJQIxFH/U3hCHluOIgx29vJO6x5ZKsomuY+A2bJiSm/5BXCiOjw+mmhxcn3QpAL
-Vq3NIrwktJ0Pw032Zlq/tuXS49IqmjxrzS2QOLmpcaXc8ursZmSRK2orz2wWTmey
-hOxi25WACyoodZsOhDkEzk6BAsZ3m5EthRFRN/CCuQOypM7gCDyWfi8IG4VhjWF7
-vG+yxKDzmc8x+Pp54e9UmhZqrWxVQSMizAgN7PR4sCttHAD3u+6ZQE3+BChaiOi/
-1qmsSblzfevicO52NTBtVualgdg+cJLud+KXb4y2D9FuuNx6LCiGqcXbZL9HWjS9
-uU1R3o2gjfP9bkvMiiS0dyOSe6uB2cz1mhMYXIMSmOI
-> piv-p256 grR75w A9xb8bDkn9NoPrqJVz+Pq62aBlVhvEpvlTkYSqQK6Bj6
-zKKfuypW1jr5WdfgTQ1xbS/oPVOKqLuaCesUSmpdy9I
-> piv-p256 RQguQQ ArnOuG+dvQSvNKluOsGUCrELfdHHrZjgTdemAV7PAiHD
-S29Fr/W0WM21233BHke55n1lPkOwS9ODb+w6Czpmi6Y
-> n-grease E?N# =%p3
-hscPaeh67dgm+5Ed4XRq2UpPlrOq7K4XBU6kFolY5J1tuPwmXyy7l5rKn6H5uAOe
-moHhxdYAuv+qZ9x9UMfbWc+gWEpqBg0EASU9GT63hyvYmg
--- EIQQsMJnWzbdR5xE6cn6Y7GEM6M5TUrOH/TymQMfYWY
-£�%å2Ðcó|àæüþ””D‚··•çÏL¶Ø�DQ<´Œa|5LÖ+cvŒVº&�ž
+XTL+rQuSTsY42cuFi2HKBo/6xRa+5Aw0NJafCDg4PBYbNvZf8Q4EFtrX3k3JzUcE
+fgzJI81h/ijl6FzvnAsfB0oMR/RIxHNdheIMxilsiaVGDS6ATnq8Mk7Ca67MtM5Y
+Uc9XQ6I4qtL3rdpvnp3BjR3d1KfmwsTBeYJrl03vltLBN8twgD7mBabtjcl38u1A
+emcgc8qAhz45n+07yVnqRqdMUY3VntqyL2DzasaPhpQHqV0jwWATNMGJilpvOSpn
+it5VGZWGVjjHiGtwEGvuWBRi2+4jt02WwrDmlrqoSZxiqXW42XCa9pPn/X+U1UYE
+dBJ1iPNc9EEQhr3sIewDAvjy2m4T/4wzY1gpgfiAY1FzgObZXOM3cv11yIAJU0ZX
+nnDTgJmRysxvp/at1dEDbza8krIGcBW0tWYvKQdm2kh3m+nTZWI2Btmm+hT60qYX
+4pLNkz0WR1nwdzzw0mSYXbPLlFAb8OrKP8fGJKvC6VM8C/Tofp+gWbfGnAFIq0um
+hBcCK3hlg/QDdBV3jrIQyX+Vk+W3xe5QMjI8Oem9Jzy/y4MmMjUV7x8X5hd6KiK9
+wc5Dt0VL1KgwomYLvrNnl32TAGK+tOVXPRLaFiR9jwsrJZ3GXlsxJO0W2hFjp3wk
+GGX/CFqRy228of9ujc+yPi6r9SO4BNT0eelwEbp0Kfs
+-> piv-p256 grR75w A4dwZqBbpqrb3KcacC1mupb7Nka8s7RlHfVcc07L1ApC
+5xM0zPEnRoA08LEdQDl3qcsOaNXPHgyDJxfRV3ar8cA
+-> piv-p256 RQguQQ AgC34mS9BXHs3UM7Xp7e66oMUKAJ7VASdxRCJuWnzZcz
+oOFQFWLUkQyGvHvmq2dZHDiE9J4J/wE3NBT1ASHtKRE
+--- fbj8iFIYKQvjNminxZ0TLt7S2RSdozKUhq2ARdI1L9s
+á>H¿ôý&‡3§LÈÊ<,DvÜ�c¨ìá†ïBIñdJÐi%þgK×³`úª³…g�9kN¹CPºžÁù«öb›ï	ÒÜêáa�œés=áÏ"S
@@ -0,0 +1,23 @@
+age-encryption.org/v1
+-> ssh-ed25519 0qfOZA UTOzjwhqcVLmpf3P/nzO3aGKzKH0YKq04sUbFvMa/FE
+a2MMcZXucDEXmy/uU7JapMsboImCGsUiPA2Pr/wB5yQ
+-> ssh-rsa VtjGpQ
+Nr2g/ocV0oTbZydmcRnESyI4VOJdMGafozm80EMarbQfmeeRCfi76jxct/gpnL00
+P/2d/3pfvqbpuGZRg+Q/BCY0Vm2AujJ1P2UTxpnzC42iZu7qKWd5EY4z0Hok53kg
+McPh+pgNhugLr4Yh2KHpT27FfJpD/Pmjajg7G78Q9P5uel6SKXIW4uFO4Lp2yLC/
+vC52XMqxLrR9moCTr72dQPzd0IIhQ2vN9EtZkBnxUW6zt3ILAYJ06VLAGvVwXIWl
+0Wjs3G5g5v+H2e+Em5vIy1hdub/3orEL4racHO0m0binK/IVRJY7sjZDVDrrerFS
+SqPORQ3a7jmuHFeHxwAlRcmh/O1gEgAnCZTZRfQzgXI+nfPEzuL0yENd/ksUPBdm
+q2zQSv1rrj/tLMtxk4vpG8FkPp5UctaYignvHAp95xC+TR14aDUdT4x4MGboHIxu
+l6Q3evVJzblwIl3JbzpP3yOA2k25Y1KI+nVDrTqAdi+Yy4jtIOA+XancIHrpLzAO
+21JO1wwGtAsjUDCdhnYSyMcOiRLRHzPoK7o/BGx6b1Uqk2WmWhZnZft9MHPp2RtX
+Gv3PBMVjz2CO+f3d8B4akPSApgQ9fw1Vje5fY0CDWdORV7tHDCKb6fmTua2d73Iz
+ANrKYonqWhjf3F9u7zzM8/xd593AH/Y+aJo+z0S+Z6I
+-> piv-p256 grR75w Ap4du3RBcNdRvbwjQTpP5PPXtNCRuoQePt6ULYEpNM1r
+4Qe4c6j7df/TajuxM5Q1qnC/TCBNNI5K9WCDqD4VM1M
+-> piv-p256 RQguQQ AoR+aGTAQ6VELef54cGpukkWjeKz37tDbW93ncGWFsrI
+KbF1N14PYEQ28a/MePeq7hW9LAgUaNriFo6UO0eBvt4
+--- F8GiyUf87+vhg22ldWuC2j5K8WGAK3y5lRDG6yrzBPQ
+að$ß-“¼|‚h.cr38ÓÉÁéPwú3üÝNhà„†B¬j	!z^�² bÄ8cªâ½m‘sç¤
+–\Ü3û»ÐÕfòx3|ùNeÍ
+=:³
@@ -1,24 +1,23 @@
 age-encryption.org/v1
-> ssh-ed25519 neExcQ RDBfN3hHc4t2uXmUVSsM14iRM7QlD6D14Mh/GNxaOEk
-fWoP465OcTE0+fKHkaAi9k5z5Al2Jiu9DKlo7CIiMpU
+-> ssh-ed25519 neExcQ VfWt68buOl2UetDKcQWuWRSOeJi4HhQxiZVI4lIfcUU
+GTWI83cLyP2Kjd6twRpaWpBq+U/BYcfDJeljQ1CZ1bw
+-> ssh-ed25519 WiIaQQ nqwbWtevakrHk3sODtw7l40klSb4cIyi4uSsnpcS8QI
+PxfriZ8CdPhPTNtjQL3lsyjfjkpBsnmJc0TRNM1pyHM
 -> ssh-rsa VtjGpQ
-dtQlOzCEvQrKY7VJNBfHs51jdBMDv4emABKlXciR3C5RXKoUxQn2QEi3hWPVrYe8
-19IuKy4HNXhhHoj9WdlJXtwGnSkrDdj69Y9yghMAjMfmTzZJpKYZVS2Av3w6hsxP
-fzCeDXZAVyVyEBrqeSDzttTH4HBj88ZHJQ1Sw6fjpXr4gO+nh6xqxU83WGmbEqkr
-baz/Po5veenEcAiIru9VnyOdEQ6BQBNWXfbhXozOK/1p8+bqVrtaCm+2UMrh9fHn
-YY5TgLdKU1TA7I+tUUbLUGv7lLi480NMmnjZeQi2AcIGzJt0SqALU48CMsZlAjgK
-f8N9dat9oGsulwnZT7uXTtjL23L0g+UZtRU3POaAMFVgT3rc0oIlgPHM4TcTeGE6
-wAs2RoTwcNMDpYDZADw2PIFs71ty3Wpp+Hh5USB8TQDQXwoJ+asvugLSBmf3LOVH
-uEQg6AePiJzatwQv8lEu++1zClovoe1r7+vwWI8EcfHXhm76jCbWD8htYBLanq3I
-jopwN2uPfEUM6KdVUERd8edj6zql0qWb3RAkrye++FfaOPQPEBP8SkJTQtr/1r4S
-EXBK8FRLDnR/Tj6e5NvRHjQtz3xDhzCxPuST7W8053bzgYBqsK/XA6QCsUus3K0m
-LR2v7z5w9nmpWe1S1kf9kVqHliBAekNqkgSIcHoLY40
-> piv-p256 grR75w AzHNBnWeZ37iFNZfHmNmfKGmNQGgjGOb5iHqGd9kKMtJ
-D9zNivOdNr20LJTrobtO2zfT+CqrBbCBQZ/BGK4a3jI
-> piv-p256 RQguQQ AiS8dCP+OW7/c7MfkQDpOI7lBtOAyV0jxpz3uLQQ4Uhs
-FQejiJrB6AMHAU0eVaxG0+IkcdSsdLIJFup45IWYRMk
-> !7f!ih-grease w.b90
-ZjiMU5WT9PZeIZgLCrbTUcfbHqHlXyByAE0uz6cCgeSAZWsEVH+nDUvcDM29GM3W
-gl3osueyciQye4fQc5HRVMUtcvFRH+O2NgSZIGB0B5xf56szcPhn/x0
--- otFhXJV/lLBevWDL2dFy2LI4u9D7TYmMQiBLSx2h/2Y
-Rc³‘SžÏà_â]S»g#Ò¼¢?ˆ'0€Lk9”'÷ô}ýjcD¬lCÐ�K—®˜…(yeÅ
+QRSdhHdAcGlw2c1hxGNmtAp5tPcjQ7CI+v9JkOyOH9W9KF3uOfshrpkz/psFPd+s
+6eqQDAwEAgla4pO6FHj/H2PK9KDHY3j2e8BZyvJ8ZsefUsSAYJ92hcD3fdISL+kc
+FMx4Dlm9LSeGGqElbPotyU69t2O/WLF01HqLDVgHrlyTzWvQMhvATA5Yzcj1Izb
+0AlA7IOE174E448/Ovo5a2T+DF0w2vLEPruH90Kvs2lui+i8yC3StgBwB6flmSfc
+dSR5qO0XCZ8gK/kkdsz2iZonsBCbEugQayN+EoE8vop6YlPW36EtO8IJnVnKmVEX
+vy/Rj3dubm5Wsp2hAyeXSXx3ity5fdSJ3TVY7TiPLPlt1yik3Wggtv0DlgZK0AML
+x1OJbrZRrzDZKYzxXw69+lOiV5XfVUfk9PXC+IAj3xf/dEz93b6Pief+PbOQg+tz
+INDWkL67/Yx6rEf41iLCsQananBV16IeM2SndRyrmT/1OCcLUR/8xqBHfOg/K0kp
+lHL7D7/neqRh2E8KOEciHgWFqWT/tV5XpyZVvA8OiYLoVbmLG55q4pexrDfQ9OgT
+ZDIL94VjiBDH5BmPfxLhRZP/58EhLSDH3WziIWnv6Y2Y1bAl5qiRU4tEV0RCHqyJ
+xEeLcqI5uFwDmmt881zlyAb38oQCGq/YRXhGygwwn18
+-> piv-p256 grR75w Ayt9mI1/BJg96jlkLVjf7xhDoklNuoFe3ZeKLYzFqDPO
+S3vFS+S4ZVC2O00P5u5GKaLtbabBPUCuuFNFFxcmmUw
+-> piv-p256 RQguQQ AqsDGN35gXkyWaKSRVATyt1Ap5gzLKiAx+UHwhVXdhhG
+YUqypxYBQ2RYbnMclNa8PSLV6atbVRCho4wHUCZegkU
+--- Bay62OwVx/Q8Nf5MHRu7VOWzwh1LtkWbxQytL16Y5Zg
+Én(/GZvÞÑ ç!ï¦¾™¡�fs×à–#…¯Âv5”K_àètûk‰ë³s7PÈÚèßÂÉk
@@ -0,0 +1,24 @@
+age-encryption.org/v1
+-> ssh-ed25519 neExcQ XvGpJsiChcxBbL7c5CK2mUvdFHV5ypmx5tpWVfwuESg
+1WI2nm5/oPtCqXD0N2WStDOh91UT7IIS4/vFwWL6UA8
+-> ssh-ed25519 WiIaQQ SLJfhzdJpYzzzqFqrR67GrAuTWFJYfX10iidobo5xxs
+KF+r/AOKKLHqSf1h5AOJd/3IZTKm442ejUnWVhk04/o
+-> ssh-rsa VtjGpQ
+AKdJLoXUUX82mhV84R8noG1qLnD/uvArV0gsYxJuS0hTnkZOyxV1XgqgH6UrgaUw
+G6Q7aYbiNYMA4+6rhyWOnH8I5QRcCVEK5y8jtiyTEU3QaPAXVhEq1NpfzrsyHd7w
+CB8mfSSAG9jE1owvuuubxEqx4YKu1oH9kh37GIeKmJlz67qJGqT6BnRMMxpU46xA
+C0+c/3CURj4N4fFtxWNVpxb8v4tUYRmA1Jq/FnqqdAqFIyw466eQVglT8YDQJvHs
+ufyR7Gnbk94qvXXg5G878eviQL2T+c/xEtVEyLeHs017dNq5FxeBBzEMwqAKshCh
+OtH4AJt+U0Rzq0JTIpRH/0V1exK1PM/9DL1KBQPAlfUBb9iYwKsQo6LieXS+Qowo
+qMTPD3xSfOD6uzmKhXCdWKZWZT6S2hwHjeXzXjYjkhErjbwjj5c2v4UpXpwdVlNN
+zocqPxVGCplFuiME0vLsuztiWtei2yH9ZgFKxNS/kxm8GfhyelAnAQng3r25YYwZ
+nLgGP0bcADAgwgXGTFxlyY2qoM9MKgnbjhtfwImLlF+WbC+IOUwBDklSgq830MKO
+ZQVccNwuZoO+jivXpfGM4XApK7pUXlz/0nc8jRE7u2zXpXLqv+fLXxgTXFYlrogT
+66dmjeUBrB/kMS2IP52ZdpdO3eGY1a75H5W+DtMeAOU
+-> piv-p256 grR75w A4Gic6auHqevWiBh3WizXvYxjX6e6JToxNBXEMM5SZxL
+0epbF/vqJyp3Cn4Hr3ay751J1I089Hxus1vn8jgCa8g
+-> piv-p256 RQguQQ A12b6QQk3G0/ksYw0D0Rfx0DKMYK5Lnfi2q2tdtMoEfr
+zqAf5KbFsPpemu2I9YaBNipQsiz2Lo3JbuxZ1gMNQl4
+--- a92cT7ctHL8S0/tTCY/rkfy94THEcoaIEPL3vLrW9Z8
+ú
+u+	Tò®:¦MëäÏµOã+tôX'§r…ï
@@ -0,0 +1,23 @@
+age-encryption.org/v1
+-> ssh-ed25519 neExcQ 39vMfysEahyydxnqENrwNOZi9yWpZSIWsNQxkMFBQik
+bvJK5Gya20UhZ/dWKHAQZ7CPa7v/pISwB90WJejYA5k
+-> ssh-ed25519 WiIaQQ KZ6RU6kDjHVfy5YwlmjQhH6YBVkJqrRonUl02iYA2m0
+GGsCI2D1tN4lGpsHJph6pq9N8UYdG2mfIY3U9urTR08
+-> ssh-rsa VtjGpQ
+a0oXJCsFZdtpHuZIASZUp5C96ZP1QU1I3RSpIe59hnnpGLbXZE2qntXBfQ9ojkBW
+bgNdxvAcWLaYAiCbe6Bo3S9+Q2svJQlEqIZ59o2H9jh+swSoLfWgi0Blo/56B0GQ
+UrltI0ftMhM20TaszHwmVhvo3yODcZpNhjAMNVkQuAov9BSQdgGRgivBnt1FfYYI
+f6nqfrE5JVoemk72Ip4jQFVWylK7drEU9W2WlwOsF9zkHOJxdNWiaaHpmnsgOEzA
+BIdVqYZTtRElqDKM3j4SdE7hL6i4fIb4QAsfX5XI09eUDQLSRGF2o3lqQ4FVx+hb
+YE31vr6yQEObTCbrf7zmKIK5UwgQbMf8+WbCxDdxF7FqTKrg7jVhPtu+n6UsJlzv
+CXsJkKYZwyESZ5oNjCyqYkkkQP0JChl886OPFY507/Xn3gl3qj/Sh7FZyUuLZ92X
+aTHCJ5AHGwQKFnVO1YLXWDcn0F3NIq90YHJ1NsxNvNXZJmcCyBTMtDJGq3q/6Xqz
+qXpVoT/9XHHStrKYvi2lut/PFMC6nciixmiNaVbE5Aok5eNhG8wUTsUVRIr8+O/i
+07aQBeg7RJ7lW6oQ4/kdfufQbQHuQNchQzkdvQf3azXCXBTJ/+Z6uQuVg32MVsjq
+fRO2BtrWjsAVThpeVAdfQb2b43wmL9HBhivqYaBK1gI
+-> piv-p256 grR75w A9sg2H7x+75AK9ErkbqMkC06KEDy2Q34seCXCGUguz6H
+1TchlkXOzymAT+eDr4bpwugeLQ7gAKRvdYC2xcd9DL8
+-> piv-p256 RQguQQ A364N/An/SMqBAp0yrLB0/osdlmz/MgZFG4RB6Os2fLX
+V4qtGLbpJrTTFWCfTMcWpuVUiLflDdxXkMqPOtG1R/k
+--- O4Xqa0RavBa09l9txN/oIQjAeZIYsur2UsxaSRmhAdE
+«à´�`˜Ñò°DkÚÊ/9¤ÊÀo Qz–#fINª¶J�ú3•KoÚµ@§>·Zzê²Ip•ÃÚhäû
Author	SHA1	Message	Date
Kabbone	0249d17ac1	restructure desktop/wm and remove nur	2024-05-19 17:57:35 +02:00
Kabbone	a3f253bd53	flake update	2024-05-09 21:28:57 +02:00
Kabbone	034bc1e4e0	flake add hydraJobs	2024-05-05 20:12:39 +02:00
Kabbone	bd07e688fc	flake add hydraJobs	2024-05-05 20:09:55 +02:00
Kabbone	32133438d9	flake add hydraJobs	2024-05-05 20:09:02 +02:00
Kabbone	d95cca9908	flake add hydraJobs	2024-05-05 20:05:19 +02:00
Kabbone	6f278377d7	flake add hydraJobs	2024-05-05 20:04:01 +02:00
Kabbone	731e4e33c5	flake add hydraJobs	2024-05-05 20:02:15 +02:00
Kabbone	bca0dddb1f	flake add hydraJobs	2024-05-05 20:01:08 +02:00
Kabbone	b88a5b9a2a	flake add hydraJobs	2024-05-05 19:58:51 +02:00
Kabbone	f864f543b8	hosts: dmz: enable hydra	2024-05-05 19:39:35 +02:00
Kabbone	941276e83f	flake update lanzaboote to master	2024-05-03 14:51:11 +02:00
Kabbone	f54df874d4	flake update, lanzaboote to master	2024-05-02 15:29:56 +02:00
Kabbone	a83c214180	flake update	2024-05-02 14:18:50 +02:00
Kabbone	8e7629da2e	font: try cascadia code	2024-05-02 14:16:25 +02:00
Kabbone	941e8a5dca	remoteClient enable Client again	2024-05-02 11:38:40 +02:00
Kabbone	522966f808	virtualisation: typo kvm module import	2024-05-02 10:13:43 +02:00
Kabbone	62acac7285	virtualisation: restructure kvm module options and enable libvirt by default	2024-05-02 09:56:41 +02:00
Kabbone	08aa2cd458	hosts: nasbak: add bypass workqueue	2024-05-02 09:46:49 +02:00
Kabbone	d65b9b558d	hosts: nasbak: change name to match hostname	2024-05-01 16:16:33 +02:00
Kabbone	64545e3086	flake update	2024-04-30 22:01:00 +02:00
Kabbone	02267d4825	hosts: server: change to kabtop	2024-04-21 15:06:42 +02:00
Kabbone	0a0ba2b5a1	flake update	2024-04-20 19:09:16 +02:00
Kabbone	1f7f453fc3	nvim: initial config	2024-04-20 19:09:03 +02:00
Kabbone	a667691f49	hosts: steamdeck: disable luks workqueue	2024-04-20 14:17:30 +02:00
Kabbone	d296306cb6	hosts: steamdeck: remove wireplumber overwrite	2024-04-20 13:08:38 +02:00
Kabbone	b1574ab9e1	flake update	2024-04-20 13:08:03 +02:00
Kabbone	55b518345b	remoteClient change to extra-*	2024-04-20 13:06:33 +02:00
Kabbone	b4892083e8	flake update	2024-04-19 20:49:30 +02:00
Kabbone	8d4d1e4be8	service: ollama + open-webui	2024-04-14 21:04:25 +02:00
Kabbone	653476ec32	service: fail2ban gitea match	2024-04-14 21:03:59 +02:00
Kabbone	949691b4c2	secrets: rekey	2024-04-13 13:58:47 +02:00
Kabbone	ed60b8cc2b	hosts: dmz: remove testpassword	2024-04-13 12:01:09 +02:00
Kabbone	9ee26c983e	hosts: server: fix gitea runner	2024-04-13 12:00:44 +02:00
Kabbone	21ecad4db0	hosts: dmz: get gitea runner working	2024-04-13 11:45:52 +02:00
Kabbone	a77d2243bf	flake update	2024-04-13 09:19:33 +02:00
Kabbone	51b596ea83	service: gitea register	2024-04-07 13:47:49 +02:00
Kabbone	909e2bb494	service: gitea register	2024-04-07 09:32:27 +02:00
Kabbone	ff56f1d4ab	service: gitea register	2024-04-07 09:29:48 +02:00
Kabbone	a86dbd6253	service: gitea register	2024-04-06 19:33:10 +02:00
Kabbone	c285b75264	service: gitea register	2024-04-06 18:19:59 +02:00
Kabbone	893d31d52c	server: add ollama	2024-04-06 08:39:22 +02:00
Kabbone	7bdc00290e	server2: enable virt	2024-04-02 12:01:34 +02:00
Kabbone	b70620ae99	secrets: rekey	2024-04-02 12:01:02 +02:00
Kabbone	62ac639d08	hosts: server: fix initial mistakes and add pub	2024-04-02 11:49:46 +02:00
Kabbone	9de2d29400	hosts: add server_big prototype	2024-04-01 15:45:28 +02:00
Kabbone	a0d72f98b9	hosts: server: add direnv	2024-04-01 14:03:45 +02:00
Kabbone	fa778a6040	hosts: remove channel autoupdate	2024-04-01 13:42:23 +02:00
Kabbone	3b886aa6ad	hosts: typo autoupdate	2024-04-01 11:59:22 +02:00
Kabbone	2277c363dd	flake update	2024-04-01 11:51:36 +02:00
Kabbone	d31042fef5	steamdeck: override wireplumber to nixpkgs to fix bt headset	2024-04-01 11:51:23 +02:00
Kabbone	edb0ca235e	hosts: steamdeck: disable autoupgrade for now and wifi powersave	2024-03-28 22:24:16 +01:00
Kabbone	db3a1d9ee9	hosts: add autoupdate with git flake	2024-03-24 21:28:00 +01:00
Kabbone	f3388b4dbf	remoteClient disable distributed builds and remove substituter	2024-03-24 17:17:05 +01:00
Kabbone	5b63ced9e5	steamdeck: remove yuzu, disable remoteClient	2024-03-24 09:51:10 +01:00
Kabbone	2a17f98a00	server: gitea: disable dump	2024-03-24 09:49:51 +01:00
Kabbone	77bba122a5	flake update	2024-03-23 10:55:42 +01:00
Kabbone	e1168e2a77	flake update	2024-03-15 18:24:02 +01:00
Kabbone	df5fecb899	remoteClient uses user@fqdn	2024-03-09 12:08:44 +01:00
Kabbone	a574bcf8fe	flake update	2024-03-09 12:08:06 +01:00
Kabbone	f7ef0aff13	steamdeck: add yuzu	2024-03-06 22:52:28 +01:00
Kabbone	b1e9a4fb94	flake update	2024-03-06 18:59:24 +01:00
Kabbone	32e7e7eb02	nix flake stick to default input	2024-03-03 17:01:07 +01:00
Kabbone	438717fdf2	remote Builder with default as backup	2024-03-03 15:17:58 +01:00
Kabbone	e6b35bfc2a	flake update	2024-03-02 21:10:11 +01:00
Kabbone	aaff72d9f0	nasbak: correct btrbk target	2024-02-29 12:54:30 +01:00
Kabbone	8c6d79ca6f	nasbak: change to 2.5 raid1	2024-02-25 20:36:58 +01:00
Kabbone	d3101d88c9	steamdeck: use valve kernel	2024-02-25 08:12:49 +01:00
Kabbone	80178917bb	desktop/steamdeck: enable secureboot	2024-02-25 08:09:17 +01:00
Kabbone	e51e3095a1	add btop globaly	2024-02-25 08:08:48 +01:00
Kabbone	37547460ff	flake update	2024-02-24 12:42:18 +01:00
Kabbone	10f2f33cae	server: local user for onlyoffice	2024-02-18 13:53:25 +01:00
Kabbone	7b0cfb5dfa	add token for onlyoffice	2024-02-18 13:50:50 +01:00
Kabbone	98320fd0bd	increase postgresql buffers	2024-02-18 11:26:33 +01:00
Kabbone	e6d6049c08	clean up db's	2024-02-18 10:18:03 +01:00
Kabbone	b4e573b9f2	update postresq to 15	2024-02-18 09:34:50 +01:00
Kabbone	dab2e8b0ac	flake update	2024-02-12 19:49:16 +01:00
Kabbone	ef91ffd016	server: typo	2024-02-12 12:40:32 +01:00
Kabbone	10c0d47c79	server: forgot ;	2024-02-12 12:37:31 +01:00
Kabbone	b37e0cdda5	server: tweak postgresql to more caching	2024-02-12 12:34:15 +01:00
Kabbone	f750968224	server: disable jitsi, add acme to nextcloud, add office	2024-02-12 12:25:27 +01:00
Kabbone	88c2a62223	desktop: add docker alias and hotkey for sway next workspace	2024-02-11 19:47:19 +01:00
Kabbone	9ed74e74d2	flake update	2024-02-06 21:13:22 +01:00
Kabbone	ab8ad96c3e	flake update	2024-02-01 22:36:50 +01:00
Kabbone	04ae6d8317	hosts: server: make runner persistent	2024-01-21 14:24:41 +01:00
Kabbone	557aa480ee	hosts: server: make runner persistent	2024-01-21 14:16:39 +01:00
Kabbone	853ee2a917	hosts: server: switch runner to user networking	2024-01-21 14:01:57 +01:00
Kabbone	4a876f27d3	hosts: server: microvm nat	2024-01-21 09:54:32 +01:00
Kabbone	f4eb08097a	hosts: server: serverrunner fixups	2024-01-20 17:28:56 +01:00
Kabbone	1ff3ab8af9	hosts: server: get runner up and running	2024-01-20 17:09:55 +01:00
Kabbone	fc026c4157	hosts: dmz: make microvm host persistant	2024-01-20 12:02:32 +01:00
Kabbone	e2f0c80e31	hosts: dmz: work on microvm	2024-01-18 17:42:23 +01:00
Kabbone	747a9abd01	hosts: remove not used hosts	2024-01-17 17:36:43 +01:00
Kabbone	c3ff05b262	flake: add k900 cachix for steamdeck	2024-01-17 17:35:46 +01:00
Kabbone	9fea252f2c	hosts: server: enable postgres for onlyoffice	2024-01-13 12:25:14 +01:00
Kabbone	5f925a20a4	hosts: server: enable onlyoffice	2024-01-13 11:52:57 +01:00
Kabbone	7123d72902	hosts: desktop: fix swaylock config	2024-01-13 11:52:35 +01:00
Kabbone	8a5ad571bc	flake update	2024-01-13 11:51:40 +01:00
Kabbone	21386d4a63	hosts: server: redis adjustments fix	2024-01-06 11:37:25 +01:00
Kabbone	ec7c4cc55b	hosts: desktop: add freecad and gnvim	2024-01-06 11:19:07 +01:00
Kabbone	fb04e18343	flake update	2024-01-06 11:18:26 +01:00
Kabbone	69c050bef6	hosts: server: turn and redis adjustments	2023-12-29 10:19:20 +01:00
Kabbone	05ac2e175c	flake update	2023-12-29 09:46:43 +01:00
Kabbone	89c5878f9f	hosts: jupiter: move nas to zeus	2023-12-29 09:45:00 +01:00
Kabbone	ac8178476e	flake update	2023-12-27 07:51:05 +01:00
Kabbone	fff7506433	hosts: steamdeck: make sdcard automount with udev	2023-12-27 07:49:24 +01:00
Kabbone	89eb52b102	hosts: steamdeck: disable blueman	2023-12-27 07:43:00 +01:00
Kabbone	5b810ae614	flake update	2023-12-27 07:39:15 +01:00
Kabbone	1466895a1e	hosts: steamdeck: fix luks hardware-config	2023-12-21 11:32:23 +01:00
Kabbone	2aa2c10ff2	flake update	2023-12-21 11:31:03 +01:00
Kabbone	2171e29570	secrets: rekey	2023-12-20 19:37:04 +01:00
Kabbone	bc8c07914a	hosts: steamdeck: correct nixpkgs to unstable	2023-12-20 17:04:17 +01:00
Kabbone	1cd51d2034	disko: fix labels and config	2023-12-20 14:02:15 +01:00
Kabbone	a965485be6	disko: README fixup	2023-12-20 11:46:24 +01:00
Kabbone	785c95e52c	disko: README fixup	2023-12-20 11:45:24 +01:00
Kabbone	ab8c079ef5	disko: README fixup	2023-12-20 11:43:17 +01:00
Kabbone	616b1154a4	disko: add initial config	2023-12-20 11:36:49 +01:00
Kabbone	38c4f44dc5	flake update	2023-12-19 16:05:53 +01:00
Kabbone	3c0089c26f	hosts: rearrange order in hosts	2023-12-19 16:05:48 +01:00
Kabbone	b7a5d90616	hosts: laptop: add missing zsh	2023-12-19 16:05:44 +01:00
Kabbone	3bb1e6c8fe	hosts: laptop: enable fido unlock	2023-12-18 16:00:19 +01:00
Kabbone	7dece1e338	flake update	2023-12-16 11:59:35 +01:00
Kabbone	883522adf5	hosts: steamdeck: switch to unstable	2023-12-16 11:58:44 +01:00
Kabbone	c018da4b11	remove remoteClient and steamdeck module fix	2023-12-15 22:08:12 +01:00
Kabbone	ba41252e6f	flake update	2023-12-12 21:45:05 +01:00
Kabbone	5370c7eaf1	secrets: rekey	2023-12-09 17:12:25 +01:00
Kabbone	09cdbad9ab	apps: desktop: switch from superslicer to prusaslicer	2023-12-09 15:04:00 +01:00
Kabbone	100e491bfb	tag home manager to 23.11	2023-12-09 15:03:27 +01:00
Kabbone	93bde6beca	flake update and move to stable	2023-12-09 10:23:27 +01:00